CVE-2026-71880
Received Received - Intake

Template Injection in GBIF IPT Before 3.3.4

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Mandiant Inc.

Description
Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-71880
EUVD
EUVD-2026-61140

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gbif integrated_publishing_toolkit to 3.3.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1336 The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Server-Side Template Injection (SSTI) flaw in the GBIF Integrated Publishing Toolkit (IPT) versions before 3.3.4. It allows remote authenticated attackers to inject malicious template code into specific metadata fields, which the server then executes. This can lead to unauthorized access to server-side files, runtime variable inspection, and potential command execution on the underlying system.

Detection Guidance

Check if your GBIF IPT version is below 3.3.4. Inspect resource metadata fields like Description, Title, Identifier, and Bibliographic Citation for unusual content or template syntax. Monitor server logs for unauthorized file access or command execution attempts.

Impact Analysis

If exploited, this vulnerability could allow attackers to read sensitive files on the server, modify system configurations, or execute arbitrary commands. This may result in data breaches, unauthorized system access, or disruption of services. Exploitation requires authenticated access with permissions to manage resource metadata.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust from users or clients.

Mitigation Strategies

Update GBIF IPT to version 3.3.4 or later immediately. Remove or sanitize user-controlled content in vulnerable fields. Restrict authenticated user permissions to manage resource metadata. Review server logs for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71880. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart