CVE-2026-811808.8HighCWE-20

CVE-2026-81180: SysReptor: Authenticated RCE by insecure image processing

Syslifters · sysreptor

Affected: Syslifters sysreptor · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.7%probability of exploitation in the next 30 days

52nd percentile

050100

Higher than 52% of scored CVEs

8.8HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker can combine that behavior with a race involving GnuPG configuration files in temporary subdirectories to cause GnuPG to copy attacker-controlled Python code into the application code directory. The injected code executes with the privileges of the SysReptor application process after a worker restart. The Community edition is not affected. Version 2026.58 contains a partial mitigation, and this issue is fully fixed in version 2026.61.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Syslifters · sysreptor< 2026.61

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Improper Input Validation · Input Validation and Logic
Vendor: Syslifters
Published: September 2026
Band: Unlikely (under 1%), September 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-81180 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.