CVE-2026-26001

8.8 highEPSS 0.2%

High (8.8) in glpi-project glpi inventory. EPSS 0.2% chance of exploitation in the next 30 days.

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, non sanitized user input can lend to an SQL injection from reports, with adequate rights. This vulnerability is fixed in 1.6.6.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-03-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

glpi-project:glpi_inventory

References

https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-gp4r-m42c-wvgx

Check your stack JSON