The vulnerability allows an attacker to specify a filename in the "saveTemplate" parameter while the "execute_mode" is set to PREPARE on the "run.php" endpoint. This flaw operates as a directory traversal that enables a remote attacker to create or overwrite any file within the scope of the web server’s file system permissions. The effect can be a full compromise of the host, as the attacker can write executable code or modify critical configuration files. The weakness is a classic example of improper input validation and access control (CWE-22).

This issue affects the Reportico Web application version 8.1.0 and earlier. Versions newer than 8.1.0 are not known to be vulnerable. Administrators should verify the installed version against the information provided in the vulnerability research GitHub repository.

The CVSS score of 9.1 classifies this vulnerability as Critical. The EPSS score is <1%, indicating a low current exploitation probability, and it is not listed in the CISA KEV catalog. Nonetheless, the nature of an arbitrary file write provides high exploitation potential. Exploitation requires only a normal HTTP request to the vulnerable endpoint and no additional credentials. Attackers can craft a payload to overwrite files such as the server configuration or deploy web‑shell scripts, granting them remote code execution under the web user’s privileges.