# CVE-2026-81182: SysReptor unauthorized file disclosure via shared note link

Source: https://junglewise.ai/threats/cve-2026-81182-sysreptor-is-a-fully-customizable-pentest-reporting-platform  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-81182 · Severity: medium · CVSS 4.2 · Published 2026-09-18

SysReptor is a pentest reporting platform used to document security assessments. An attacker with access to a public read-write note share link can trick the system into granting access to uploaded files or images they shouldn't be able to see by manipulating note content. This allows disclosure of sensitive project files if the attacker knows the target filename.

Technologies: [Syslifters SysReptor](https://junglewise.ai/threats/technologies/sysreptor). Vendors: [Syslifters](https://junglewise.ai/threats/vendors/syslifters).

## Quick answers

**Is CVE-2026-81182 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81182 being exploited in the wild.

**How severe is CVE-2026-81182?** Medium severity, with a CVSS score of 4.2, published 18 September 2026.

**Which products and versions are affected?** Syslifters SysReptor before 2026.68.

**Is there a fix for CVE-2026-81182?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-81182 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-81182?** Check whether you run Syslifters SysReptor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass exists in shared note handling where user-controlled file references in note content are not properly validated before being treated as permitted assets. An unauthenticated attacker holding a public read-write share link can update the note to reference an arbitrary asset filename, causing the authorization logic to incorrectly grant access. The attacker must know the target asset filename and cannot access files outside the shared project. Fixed by making pending_file_ids read-only and tightening file reference detection.

## Affected products

- Syslifters SysReptor before 2026.68

## Timeline

- 2026-09-18: disclosed

## References

- [https://github.com/Syslifters/sysreptor/commit/1b721e291ebadfc1457bc8d01f7c70fe5da4b035](https://github.com/Syslifters/sysreptor/commit/1b721e291ebadfc1457bc8d01f7c70fe5da4b035)
- [https://github.com/Syslifters/sysreptor/commit/1f3fd629c32560fc4280294f8f9bdc44d97c639a](https://github.com/Syslifters/sysreptor/commit/1f3fd629c32560fc4280294f8f9bdc44d97c639a)

## Related threats

- [SysReptor password reset link hijacking via Host header](https://junglewise.ai/threats/cve-2026-81179-sysreptor-is-a-fully-customizable-pentest-reporting-platform)
- [Syslifters SysReptor privilege escalation in user management](https://junglewise.ai/threats/cve-2026-44987-syslifters-sysreptor-privilege-escalation-in-user-management)
- [Syslifters SysReptor authorization bypass in personal notes](https://junglewise.ai/threats/cve-2026-42291-syslifters-sysreptor-authorization-bypass-in-personal-notes)
- [SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site…](https://junglewise.ai/threats/cve-2025-66561-sysreptor-is-a-fully-customizable-pentest-reporting-platform)