{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-61707","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-07-10T18:51:13.919Z","datePublished":"2026-10-29T21:25:01.101Z","dateUpdated":"2026-10-30T15:59:08.843Z"},"containers":{"cna":{"title":"SOCFortress CoPilot: Stored case-report template injection permits backend code execution","problemTypes":[{"descriptions":[{"cweId":"CWE-94","lang":"en","description":"CWE-94: Improper Control of Generation of Code ('Code Injection')","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-862","lang":"en","description":"CWE-862: Missing Authorization","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-1336","lang":"en","description":"CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"}}],"references":[{"name":"https://github.com/socfortress/CoPilot/security/advisories/GHSA-7q83-228r-wfh5","tags":["x_refsource_CONFIRM"],"url":"https://github.com/socfortress/CoPilot/security/advisories/GHSA-7q83-228r-wfh5"},{"name":"https://github.com/socfortress/CoPilot/pull/936","tags":["x_refsource_MISC"],"url":"https://github.com/socfortress/CoPilot/pull/936"},{"name":"https://github.com/socfortress/CoPilot/commit/a5ed4a250094d1b6d15ba0ec088dbd773ab1b4e0","tags":["x_refsource_MISC"],"url":"https://github.com/socfortress/CoPilot/commit/a5ed4a250094d1b6d15ba0ec088dbd773ab1b4e0"},{"name":"https://github.com/socfortress/CoPilot/tree/v0.1.76","tags":["x_refsource_MISC"],"url":"https://github.com/socfortress/CoPilot/tree/v0.1.76"}],"affected":[{"vendor":"socfortress","product":"CoPilot","versions":[{"version":"< 0.1.76","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-29T21:25:01.101Z"},"descriptions":[{"lang":"en","value":"SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, in the reported deployment, case-report templates uploaded by `customer_user`, the lowest-privilege portal role, are later executed by non-sandboxed Jinja2 engines when an admin or analyst generates a report. The `/case-report-template/upload` route in `backend/app/incidents/routes/db_operations.py` validates only the filename-derived MIME type, not the template content. Templates share a global store without customer_code scoping, and `customer_user` can also list, download and delete them, allowing an attacker to replace a legitimate default template under the same name. In `backend/app/incidents/services/reports.py`, `render_document_with_context` uses `DocxTemplate` without a sandbox; in `backend/app/incidents/services/reports_pdf.py`, `render_html_template` uses a non-sandboxed `Environment` without autoescaping. Normal privileged requests to `POST /api/incidents/report/generate-report-docx` or `/generate-report-pdf` therefore evaluate attacker-controlled Jinja expressions as Python on the backend. The reported deployment executes commands as root, exposing all tenants' incident and SIEM data and stored connector credentials. The HTML/PDF wkhtmltopdf renderer additionally permits local-file reads and requests to internal services. This issue is fixed in version 0.1.76."}],"source":{"advisory":"GHSA-7q83-228r-wfh5","discovery":"UNKNOWN"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-30T15:34:47.697339Z","id":"CVE-2026-61707","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-30T15:59:08.843Z"}}]}}