CVE-2026-23489

9.1 criticalEPSS 0.3%

Critical (9.1) in teclib-edition fields. EPSS 0.3% chance of exploitation in the next 30 days.

Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2026-03-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

teclib-edition:fields

References

https://github.com/pluginsGLPI/fields/releases/tag/1.23.3
https://github.com/pluginsGLPI/fields/security/advisories/GHSA-rj7q-mmx9-fhq7

Check your stack JSON