Dashboard / CVE-2026-26026

CVE-2026-26026

HIGH
MEDIUM Priority: 0.83 BB Relevance: 62/100
Published: 2026-04-06 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: None
S: Unchanged
C: High
I: High
A: High

Description

GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in 11.0.6.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
glpi-project glpi 11.0.0 – 11.0.6

References & Advisories (1)

Bug Bounty Relevance

62 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.2 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

11.53%
Raw Score 0.115270
Percentile 96.0%
Date 2026-10-29

EPSS Trend

2026-10-29
0.11527
2026-10-28
0.11527

Intelligence Sources

nvd ref →

External Links