CVE-2026-81180

Image upload triggers Ghostscript, GnuPG race writes Python for code exec.

• CVSS 8.8
• 20
• Race Conditions
• Remote

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker can combine that behavior with a race involving GnuPG configuration files in temporary subdirectories to cause GnuPG to copy attacker-controlled Python code into the application code directory. The injected code executes with the privileges of the SysReptor application process after a worker restart. The Community edition is not affected. Version 2026.58 contains a partial mitigation, and this issue is fully fixed in version 2026.61.

CVE

CVE-2026-81180

CWE

20

CVSS base score

8.8

Published

2026-09-18

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Timing/Serialization

Code defect classification

Timing Issues

Category

Race Conditions

Subcategory

Race Condition in File Operations

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

SysReptor

Solution

Upgrade to SysReptor Professional version 2026.61 (or later).

import os
import subprocess
import tempfile

def verify_image_upload(image_path):
    # VULNERABLE: predictable, world-writable temporary directory used for GnuPG
    temp_dir = f"/tmp/gnupg_{os.getuid()}"
    os.makedirs(temp_dir, exist_ok=True)
    subprocess.run(["gs", "-dNOPAUSE", "-sDEVICE=pngalpha", "-sOutputFile=/dev/null", image_path])
    env = os.environ.copy()
    env["GNUPGHOME"] = temp_dir
    subprocess.run(["gpg", "--batch", "--verify", "uploaded.sig"], env=env)
    os.rmdir(temp_dir)

import os
import subprocess
import tempfile

def verify_image_upload(image_path):
    # FIX: securely generated temporary directory with restrictive permissions
    temp_dir = tempfile.mkdtemp(prefix="gnupg_", dir="/tmp")
    os.chmod(temp_dir, 0o700)
    subprocess.run(["gs", "-dSAFER", "-dNOPAUSE", "-sDEVICE=pngalpha", "-sOutputFile=/dev/null", image_path])
    env = os.environ.copy()
    env["GNUPGHOME"] = temp_dir
    subprocess.run(["gpg", "--batch", "--verify", "uploaded.sig"], env=env)
    os.rmdir(temp_dir)

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202681180,
  title        = {{Image upload triggers Ghostscript, GnuPG race writes Python for code exec.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-81180},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-81180/}}
}