CVE-2026-23489criticalCWE-20

CVE-2026-23489: critical vulnerability in pluginsGLPI fields

Fields GLPI plugin vulnerable to RCE in dropdown generation

Published

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 0.3%
exploitation probability
0.3%top 79% of all CVEs
observed exploitation
nono source reports it
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
pluginsGLPI · fields
Related CVEs — pluginsGLPI fields

In the same product, most dangerous first.

CVE-2023-28855MEDIUMFields GLPI plugin vulnerable to unauthorized write access to additional fieldsEPSS 0.6%CVE-2024-45600HIGHFields GLPI plugin has an Authenticated SQL InjectionEPSS 0.5%
References
https://github.com/pluginsGLPI/fields/releases/tag/1.23.3https://github.com/pluginsGLPI/fields/security/advisories/GHSA-rj7q-mmx9-fhq7