PT-2026-25776 · Glpi · Fields Plugin

Login-Securite · Publicado 2026-03-16 · Atualizado 2026-03-17 · CVE-2026-23489

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GLPI Fields plugin versions prior to 1.23.3

Description The Fields plugin for GLPI allows users to add custom fields to GLPI item forms. Prior to version 1.23.3, users permitted to create dropdowns could execute arbitrary PHP code. This allows for the potential execution of malicious code through the creation of specially crafted dropdowns. The vulnerable component is the functionality related to creating dropdowns within the plugin. The createDropdowns() function is implicated in this issue. The vulnerable parameter is the input provided during dropdown creation.

Recommendations Versions prior to 1.23.3 should be updated to version 1.23.3 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2026-23489

GHSA-RJ7Q-MMX9-FHQ7

Produtos afetados

Fields Plugin

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23489.json · Exploit
• https://github.com/pluginsGLPI/fields/security/advisories/GHSA-rj7q-mmx9-fhq7 · Aviso do Fabricante
• https://github.com/pluginsGLPI/fields/releases/tag/1.23.3 · Nota
• https://twitter.com/0dayPublishing/status/2033595181023351241 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2033614929119310147 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-23489 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-23489 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2033618046301180276 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2033755341318430832 · Publicação no Twitter