by Kastro
Paper/Archive/CVE-2026-23489

CVE-2026-23489

pluginsGLPI fields — Fields GLPI plugin vulnerable to RCE in dropdown generation

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
32
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 23.4.234 × 204.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.

Affected

ProductAffectedFixed inSource
fields< 1.23.3–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/pluginsGLPI/fields/security/advisories/GHSA-rj7q-mmx9-fhq7refgithub.com/pluginsGLPI/fields/releases/tag/1.23.3