PT-2026-25776 · Glpi · Fields Plugin

Login-Securite · Published 2026-03-16 · Updated 2026-03-17 · CVE-2026-23489

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GLPI Fields plugin versions prior to 1.23.3

Description The Fields plugin for GLPI allows users to add custom fields to GLPI item forms. Prior to version 1.23.3, users permitted to create dropdowns could execute arbitrary PHP code. This allows for the potential execution of malicious code through the creation of specially crafted dropdowns. The vulnerable component is the functionality related to creating dropdowns within the plugin. The createDropdowns() function is implicated in this issue. The vulnerable parameter is the input provided during dropdown creation.

Recommendations Versions prior to 1.23.3 should be updated to version 1.23.3 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-23489

GHSA-RJ7Q-MMX9-FHQ7

Affected Products

Fields Plugin

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23489.json · Exploit
• https://github.com/pluginsGLPI/fields/security/advisories/GHSA-rj7q-mmx9-fhq7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23489 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23489 · Vendor Advisory
• https://github.com/pluginsGLPI/fields/releases/tag/1.23.3 · Note
• https://twitter.com/0dayPublishing/status/2033595181023351241 · Twitter Post
• https://twitter.com/CveFindCom/status/2033614929119310147 · Twitter Post
• https://twitter.com/TheHackerWire/status/2033618046301180276 · Twitter Post
• https://twitter.com/CVEnew/status/2033755341318430832 · Twitter Post