SysReptor is a customizable pentest reporting platform. An unauthenticated attacker who possesses a public read‑write note share link can reveal an uploaded file or image within the same project by altering the shared note to point to the target asset filename. Because the note’s reference is user‑controlled, the authorization logic incorrectly treats the asset as allowed, allowing the attacker to download it. The attacker must know the filename, and the flaw does not apply across projects. The vulnerability results in unintended disclosure of project assets, compromising confidentiality.

The vulnerability applies to Syslifters' SysReptor, affecting any installation running a version earlier than 2026.68. Versions 2026.68 and later contain the fix.

The CVSS score is 4.2, indicating moderate severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. The likely attack vector requires the attacker to have a public read‑write note share link and the target filename; exploitation is therefore limited to users with such access rather than arbitrary remote code execution. Nonetheless, the information disclosure threat warrants timely remediation.