What is the CVSS score of CVE-2026-23489?

CVE-2026-23489 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-23489?

CVE-2026-23489 is a critical remote code execution vulnerability in the GLPI Fields plugin (versions prior to 1.23.3) that enables authenticated users with dropdown creation privileges to execute…. A patch is available.

How to fix or mitigate CVE-2026-23489?

Within 24 hours: Inventory all GLPI deployments and identify which are running Fields plugin versions prior to 1.23.3; immediately restrict dropdown creation permissions to trusted administrators only. Within 7 days: Apply vendor patch to upgrade Fields plugin to version 1.23.3 or later on all affected systems; verify successful patch deployment. Within 30 days: Conduct access review of all accounts with dropdown creation privileges; enable enhanced logging/monitoring on GLPI administrative functions; consider implementation of principle-of-least-privilege for plugin administration.

PHP CVE-2026-23489

EUVD-2026-12456 CRITICAL

Improper Input Validation (CWE-20)

2026-03-16 security-advisories@github.com

PHP RCE Fields

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:50 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.23.3

EUVD ID Assigned

Mar 16, 2026 - 18:30 euvd

EUVD-2026-12456

Analysis Generated

Mar 16, 2026 - 18:30 vuln.today

CVE Published

Mar 16, 2026 - 18:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.

AnalysisAI

A critical remote code execution vulnerability exists in the Fields plugin for GLPI that allows authenticated users with dropdown creation privileges to execute arbitrary PHP code on the server. The vulnerability affects Fields plugin versions prior to 1.23.3 and has a CVSS score of 9.1, indicating severe impact with the ability to compromise the entire system. While no active exploitation has been reported in KEV and no public proof-of-concept is mentioned, the straightforward attack vector and high privileges requirement suggest targeted insider threat or compromised account scenarios.

Technical ContextAI

The Fields plugin extends GLPI (an IT asset management system) by allowing custom field additions to forms, but contains an input validation weakness (CWE-20) that fails to properly sanitize user-supplied data when creating dropdowns. This improper input validation allows injection of malicious PHP code that gets executed server-side, providing attackers with complete system control. The vulnerability specifically affects the dropdown creation functionality where privileged users can inject code that bypasses security controls.

RemediationAI

Immediately upgrade the Fields plugin to version 1.23.3 or later, which contains the security fix for this vulnerability. The patched version is available at https://github.com/pluginsGLPI/fields/releases/tag/1.23.3. Until patching is possible, restrict dropdown creation privileges to only the most trusted administrators and implement additional monitoring on plugin administrative actions. Review the vendor security advisory at https://github.com/pluginsGLPI/fields/security/advisories/GHSA-rj7q-mmx9-fhq7 for additional details.