CVE-2026-23489
Arbitrary PHP Code Execution in GLPI Fields Plugin Before
Publication date: 2026-03-16
Last updated on: 2026-03-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| teclib-edition | fields | to 1.23.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-23489 is a critical remote code execution (RCE) vulnerability in the Fields plugin for GLPI, affecting versions up to 1.23.2. It allows users who have permission to create dropdowns to execute arbitrary PHP code due to improper input validation. This means that malicious input can be processed without proper checks, enabling attackers to run their own code on the server.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including full compromise of the affected system. An attacker with the required privileges can execute arbitrary PHP code remotely, leading to complete loss of confidentiality, integrity, and availability of the system. This means sensitive data can be stolen or altered, and system operations can be disrupted or taken down.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately upgrade the Fields plugin for GLPI to version 1.23.3 or later, where the issue has been patched.
Additionally, restrict permissions so that only trusted users have the ability to create dropdowns, as the vulnerability requires such privileges to be exploited.