{
  "schemaVersion": 1,
  "site": "https://cveboard.org",
  "generatedAt": "2026-10-30T00:09:14.975Z",
  "lastRun": "2026-10-30T00:01:07.007Z",
  "liveDays": 14,
  "filters": {
    "kind": null,
    "exploited": false,
    "severity": null,
    "ecosystems": [],
    "tag": "socfortress"
  },
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "incidents": [
    {
      "id": "cve-2026-61707",
      "url": "https://cveboard.org/i/cve-2026-61707",
      "urlPt": "https://cveboard.org/pt/i/cve-2026-61707",
      "json": "https://cveboard.org/i/cve-2026-61707.json",
      "kind": "vuln",
      "live": true,
      "knownExploited": false,
      "severity": "critical",
      "title": "socfortress CoPilot",
      "summary": "SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, in the reported deployment, case-report templates uploaded by `customer_user`, the lowest-privilege portal role, are later executed by non-sandboxed Jinja2 engines when an admin or analyst generates…",
      "titlePt": "socfortress CoPilot",
      "summaryPt": "SOCFortress CoPilot se concentra em fornecer uma única visão geral para todas as suas necessidades de operações de segurança. Antes da versão 0.1.76, no deployment reportado, os modelos de relatório de caso enviados por `customer_user`, o papel de portal com menor privilégio, são executados posteriormente por motores Jinja2 não sandboxed quando um administrador ou analista gera…",
      "affected": [
        {
          "vendor": "socfortress",
          "product": "CoPilot",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "< 0.1.76",
              "status": "affected",
              "lessThan": null,
              "lessThanOrEqual": null
            }
          ],
          "omitted": 0,
          "fixed": []
        }
      ],
      "omitted": 0,
      "references": [],
      "cwes": [
        {
          "id": "CWE-94",
          "name": "Improper Control of Generation of Code ('Code Injection')"
        },
        {
          "id": "CWE-862",
          "name": "Missing Authorization"
        },
        {
          "id": "CWE-1336",
          "name": "Improper Neutralization of Special Elements Used in a Template Engine"
        }
      ],
      "ssvc": null,
      "fix": "none",
      "tags": [
        "socfortress"
      ],
      "description": "SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, in the reported deployment, case-report templates uploaded by `customer_user`, the lowest-privilege portal role, are later executed by non-sandboxed Jinja2 engines when an admin or analyst generates a report. The `/case-report-template/upload` route in `backend/app/incidents/routes/db_operations.py` validates only the filename-derived MIME type, not the template content. Templates share a global store without customer_code scoping, and `customer_user` can also list, download and delete them, allowing an attacker to replace a legitimate default template under the same name. In `backend/app/incidents/services/reports.py`, `render_document_with_context` uses `DocxTemplate` without a sandbox; in `backend/app/incidents/services/reports_pdf.py`, `render_html_template` uses a non-sandboxed `Environment` without autoescaping. Normal privileged requests to `POST /api/incidents/report/generate-report-docx` or `/generate-report-pdf` therefore evaluate attacker-controlled Jinja expressions as Python on the backend. The reported deployment executes commands as root, exposing all tenants' incident and SIEM data and stored connector credentials. The HTML/PDF wkhtmltopdf renderer additionally permits local-file reads and requests to internal services. This issue is fixed in version 0.1.76.",
      "descriptionFrom": "cve",
      "descriptionAt": null,
      "summaryFrom": "cve",
      "cves": [
        "CVE-2026-61707"
      ],
      "ghsa": null,
      "cvss": {
        "score": 9,
        "version": "3.1",
        "by": "GitHub_M"
      },
      "epss": null,
      "packages": [],
      "vendor": "socfortress",
      "product": "CoPilot",
      "kev": null,
      "breach": null,
      "retracted": false,
      "sources": [
        {
          "label": "cve.now",
          "url": "https://cve.now/CVE-2026-61707"
        }
      ],
      "cveVersion": 1,
      "cvePending": false,
      "publishedAt": "2026-10-29T21:25:01.101Z",
      "updatedAt": "2026-10-29T21:25:01.101Z"
    }
  ],
  "tag": {
    "tag": "socfortress",
    "name": "socfortress",
    "kev": null
  }
}