CVE-2026-39975CWE-94code-injection

CVE-2026-39975

published August 24, 2026

CVSS
9.4
EPSS
1%
Percentile
47.5
In the wild
Unconfirmed
What it is

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions. This issue has been fixed in version 3.2.3.

The record
Technical detail
CVSS
9.4 · NONE
CVSS v4.0
9.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00591 · 47.5th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-24T23:16Z
References (1)
https://github.com/Combodo/iTop/security/advisories/GHSA-h823-537c-xwfh · [email protected]
EPSS history
Timeline
  • 26 AUG 07:59Z
    EPSS moved — → 0%
    epss
  • 24 AUG 18:50Z
    Combodo iTop: Remote code execution using external auth variable value
    cvelistv5