CVE-2026-23489CWE-20

Fields GLPI plugin vulnerable to RCE in dropdown generation

Critical · published March 16, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
22.1
In the wild
Unconfirmed
What it is

Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00306 · 22.1th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-03-16T17:12Z
EPSS history
Timeline
  • 16 MAR 17:12Z
    Fields GLPI plugin vulnerable to RCE in dropdown generation
    cvelistv5