CVE-2026-23489 - Vulnerability Analysis

Overview

GLPI Fields plugin < 1.23.3 contains a remote code execution caused by insufficient validation in dropdown creation, letting users with dropdown creation permissions execute arbitrary PHP code, exploit requires dropdown creation privileges.

Severity & Score

Impact

Users with dropdown creation permissions can execute arbitrary PHP code, potentially leading to full system compromise.

Mitigation

Update to version 1.23.3 or later.

References

• https://github.com/pluginsGLPI/fields/releases/tag/1.23.3
• https://github.com/pluginsGLPI/fields/security/advisories/GHSA-rj7q-mmx9-fhq7

Social Media Activity(1 post)

Offensive Sequence

@offseq

Mar 17, 2026

🚨 CVE-2026-23489 (CRITICAL, CVSS 9.1): GLPI 'fields' plugin (<1.23.3) allows privileged users to execute arbitrary PHP code (RCE risk). Patch to 1.23.3+, review permissions, and monitor activity. https://radar.offseq.com/threat/cve-2026-23489-cwe-20-improper-input-validation-in-9483a14f #OffSeq #GLPI #CVE202623489 #infosec

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner