CVE-2026-23489

Fields GLPI plugin vulnerable to RCE in dropdown generation

CVSS 9.1 CRITICALEPSS 0.3%CWE-20

Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products

pluginsGLPI · fields

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/pluginsGLPI/fields/releases/tag/1.23.3 https://github.com/pluginsGLPI/fields/security/advisories/GHSA-rj7q-mmx9-fhq7