Security advisory: Pre-authentication SYSTEM RCE in Stimulsoft Server 2026.3.1 (Stimulsoft)
disclosure via Fulldisclosure ·
0day Rubbish Research Team is publicly disclosing a vulnerability in Stimulsoft Server 2026.3.1 (Stimulsoft). The research is published and a proof-of-concept is available. Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication) A default-configuration defect chain combines into a complete unauthenticated RCE. The /1/signup endpoint is open by default with email activation disabled, so an anonymous attacker registers and immediately receives a Supervisor account. The Supervisor uploads a .mrt report template containing an embedded C# script. PUT /1/reporttemplates/<id>/run triggers the report-script engine, which compiles the script with CSharpCodeProvider in full trust (no AppDomain isolation, no CAS sandbox, no class allowlist) and instantiates the report class, executing the attacker-controlled constructor. The report task runs in the backend service process Stimulsoft.Server.Agent.exe as NT AUTHORITY\SYSTEM. No credentials, no SMTP, no administrator action, and no non-default configuration are required. Impact: Full system takeover; the report task executes in the backend service process running as NT AUTHORITY\SYSTEM, giving arbitrary code execution with the highest Windows privilege. Advisory: https://0day-rubbish.com/blog/stimulsoft-server-unauth-report-script-rce PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish -- 0day Rubbish Research Team https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/