{"metadata": {"vulnerability": "CVE-2026-61707", "count": 12, "kinds": {"milestone": 3, "sighting": 3, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-07-10T18:51:13.919Z", "date_only": false, "value": "2026-07-10T18:51:13.919Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-61707", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-29T21:25:01.101Z", "date_only": false, "value": "2026-10-29T21:25:01.101Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61707", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T21:25:01.101Z", "date_only": false, "value": "2026-10-29T21:25:01.101Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-61707", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-29T21:29:35.201Z", "date_only": false, "value": "2026-10-29T21:29:35.201056Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117526323179575463", "record": "CVE-2026-61707", "field": "creation_timestamp", "uuid": "361088a0-a84f-4a1a-ac91-86c24081ef5f", "content": "CVE-2026-61707 SOCFortress CoPilot: Stored case-report template injection permits backend code execution SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, in the reported deployment, case-report templates uploaded by `customer_user`, the lowest-privilege portal role, are later executed by non-sandboxed Jinja2 engines when an admin or analyst generates a report. The `/case-report-template/upload` route in `backend/app/incidents/routes/db_operations.py` validates only the filename-derived MIME type, not the template content. Templates share a global store without customer_code scoping, and `customer_user` can also list, download and delete them, allowing an attacker to replace a legitimate default template under the same name. In `backend/app/incidents/services/reports.py`, `render_document_with_context` uses `DocxTemplate` without a sandbox; in `backend/app/incidents/services/reports_pdf.py`, `render_html_template` uses a non-sandboxed `Environment` without autoescaping. Normal privileged requests to `POST /api/incidents/report/generate-report-docx` or `/generate-report-pdf` therefore evaluate attacker-controlled Jinja expressions as Python on the backend. The reported deployment executes commands as root, exposing all tenants' incident and SIEM data and stored connector credentials. The HTML/PDF wkhtmltopdf renderer additionally permits local-file reads and requests to internal services. This issue is fixed in version 0.1.76.\nhttps://www.cve.org/CVERecord?id=CVE-2026-61707https://github.com/socfortress/CoPilot/security/advisories/GHSA-7q83-228r-wfh5https://github.com/socfortress/CoPilot/pull/936https://github.com/socfortress/CoPilot/commit/a5ed4a250094d1b6d15ba0ec088dbd773ab1b4e0https://github.com/socfortress/CoPilot/tree/v0.1.76#socfortress #CoPilot#CVE_2026_61707#bot", "url": "https://infosec.exchange/users/cve/statuses/117526323179575463"}, {"timestamp": "2026-10-29T22:17:05.603Z", "date_only": false, "value": "2026-10-29T22:17:05.603", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61707", "record": "FKIE_CVE-2026-61707", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T22:30:04.495Z", "date_only": false, "value": "2026-10-29T22:30:04.495856Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mz2cwcwlso2w", "record": "CVE-2026-61707", "field": "creation_timestamp", "uuid": "7c6cbc9e-c841-4e38-9492-07443a6860ef", "content": "CVE-2026-61707 - copilot\nIf you are using SOCFortress CoPilot versions before 0.1.76, a low\u2011privilege user can upload a specially crafted report template that the system will execute when an admin\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#copilot #socfortress #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mz2cwcwlso2w"}, {"timestamp": "2026-10-29T23:46:55.515Z", "date_only": false, "value": "2026-10-29T23:46:55.515283Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mz2h7ptliz23", "record": "CVE-2026-61707", "field": "creation_timestamp", "uuid": "98583f1f-eed1-4b93-893b-733b4b788e24", "content": "\ud83d\udd34 CVE-2026-61707 - Critical (9)\n\nSOCFortress CoPilot focuses on providing a single pane of glass for all your security operations ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-61707/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mz2h7ptliz23"}, {"timestamp": "2026-10-30T15:34:47.697Z", "date_only": false, "value": "2026-10-30T15:34:47.697339Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-61707", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-30T15:34:47.697Z", "date_only": false, "value": "2026-10-30T15:34:47.697339Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61707", "record": "FKIE_CVE-2026-61707", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-30T15:59:08.843Z", "date_only": false, "value": "2026-10-30T15:59:08.843Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-61707", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T15:59:08.843Z", "date_only": false, "value": "2026-10-30T15:59:08.843Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-61707", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T17:13:54.187Z", "date_only": false, "value": "2026-10-30T17:13:54.187", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61707", "record": "FKIE_CVE-2026-61707", "field": "lastModified"}], "metrics": {"as_of": "2026-11-02T07:43:05.784Z", "anchors": {"origin": {"timestamp": "2026-10-29T21:25:01.101Z", "date_only": false, "value": "2026-10-29T21:25:01.101Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61707", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-29T21:25:01.101Z", "date_only": false, "value": "2026-10-29T21:25:01.101Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61707", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 296284.683093, "hours": 82.30130085916667, "days": 3.4292208691319446, "min_seconds": 296284.683093, "max_seconds": 296284.683093, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-29T21:25:01.101Z", "date_only": false, "value": "2026-10-29T21:25:01.101Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61707", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-02T07:43:05.784Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}