Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61707— SOCFortress CoPilot: Stored case-report template injection permits backend code execution

Quick assessment

Affected
socfortress CoPilot
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SOCFortress CoPilot 旨在为所有安全运营需求提供统一的可视化界面。在 0.1.76 版本之前，在已报告的部署环境中，由最低权限门户角色 上传的“案件报告模板”，会在管理员或分析师生成报告时，被非沙箱化的 Jinja2 引擎执行。 路由（位于 ）仅验证基于文件名的 MIME 类型，而未对模板内容本身进行校验。这些模板共享一个未按 进行隔离的全局存储区，且 还具备列出、下载和删除模板的权限，这使得攻击者能够用同名恶意模板替换合法的默认模板。 在 中， 函数使用了未启用沙箱的 ；而在 中， 函数使用了未

CVSS 9.0 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61707

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SOCFortress CoPilot: Stored case-report template injection permits backend code execution
Source: CVE Program / CVE List V5
Vulnerability Description
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, in the reported deployment, case-report templates uploaded by `customer_user`, the lowest-privilege portal role, are later executed by non-sandboxed Jinja2 engines when an admin or analyst generates a report. The `/case-report-template/upload` route in `backend/app/incidents/routes/db_operations.py` validates only the filename-derived MIME type, not the template content. Templates share a global store without customer_code scoping, and `customer_user` can also list, download and delete them, allowing an attacker to replace a legitimate default template under the same name. In `backend/app/incidents/services/reports.py`, `render_document_with_context` uses `DocxTemplate` without a sandbox; in `backend/app/incidents/services/reports_pdf.py`, `render_html_template` uses a non-sandboxed `Environment` without autoescaping. Normal privileged requests to `POST /api/incidents/report/generate-report-docx` or `/generate-report-pdf` therefore evaluate attacker-controlled Jinja expressions as Python on the backend. The reported deployment executes commands as root, exposing all tenants' incident and SIEM data and stored connector credentials. The HTML/PDF wkhtmltopdf renderer additionally permits local-file reads and requests to internal services. This issue is fixed in version 0.1.76.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
socfortress CoPilot < 0.1.76 -

II. Public POCs for CVE-2026-61707

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61707

请登录查看更多情报信息。

Other References for CVE-2026-61707 (4)

IV. Related Vulnerabilities

Same product: CoPilot
Same vendor: socfortress
Same weakness: CWE-94