CriticalVulnerabilityCVE-2026-61707updated 29 Oct 2026, 22:17 UTC

SOCFortress CoPilot: low-privilege users can run code on the server via report templates

A customer-level user can upload a report template that the server later runs as code. That can let them take over the server and read data from every customer.

Fixed in Version 0.1.76Official source

Severity	CriticalCVSS 9 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	YesVersion 0.1.76 · since 29 Oct 2026
How sure is this?	Official sourceBacked by an official source

How the attack works simplified

1Customer userUploads a malicious report template
2Template storedShared globally, no customer scoping
3Report generatedAdmin or analyst triggers rendering
4Template executedUnsandboxed Jinja2 runs as Python
5Data exposedTenant data and credentials reachable
ResultAttacker controls the server

What happened

Case-report templates uploaded through the /case-report-template/upload route are rendered by non-sandboxed Jinja2 engines (DocxTemplate and an unsandboxed HTML/PDF Environment without autoescaping), allowing server-side template injection. Templates are stored globally without customer scoping, so a customer_user can replace legitimate default templates.

Why it is dangerous: Successful exploitation executes commands on the backend (root in the reported deployment), exposing all tenants' incident and SIEM data and stored connector credentials; the PDF renderer can also read local files and reach internal services.

Are you affected?

You are affected if you run SOCFortress CoPilot before version 0.1.76 and have customer_user portal accounts or generate reports with DOCX or PDF templates.

SOCFortress CoPilot versions prior to 0.1.76

What to do

Update SOCFortress CoPilot to version 0.1.76 or later
Review existing case-report templates for unexpected or modified content
Rotate stored SIEM and connector credentials if exposure is suspected
Restrict customer_user accounts until the update is applied

Timeline

29 Oct 2026, 22:17 UTC
Publicly disclosed
29 Oct 2026, 22:17 UTC
Reported by NVD · NVD
29 Oct 2026, 22:17 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

CVE-2026-61707NVD · 29 Oct 2026, 22:17 UTC

Technical details

ID: CVE-2026-61707
CVSS: 9 / 10
Disclosed: 29 Oct 2026, 22:17 UTC
On Zero Radar: 29 Oct 2026, 22:17 UTC (0 min after disclosure)
Last change: 29 Oct 2026, 22:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works