What is the CVSS score of CVE-2026-26026?

CVE-2026-26026 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Glpi are affected by CVE-2026-26026?

GLPI asset management software versions 11.0.0-11.0.5 contain a critical remote code execution vulnerability exploitable by authenticated administrators through template injection, enabling complete…. A patch is available.

How to fix or mitigate CVE-2026-26026?

Within 24 hours: inventory all GLPI deployments and identify systems running versions 11.0.0-11.0.5; verify patch availability in your environment. Within 7 days: apply vendor-released patch to upgrade all affected GLPI instances to version 11.0.6 or later; test patches in non-production environments first. Within 30 days: audit administrator account activity logs for suspicious template injection attempts or code execution; implement principle of least privilege to restrict administrator role assignments.

Glpi CVE-2026-26026

EUVD-2026-19246 CRITICAL

Code Injection (CWE-94)

2026-04-06 GitHub_M

RCE Code Injection Glpi Glpi Project

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:46 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

11.0.6

EUVD ID Assigned

Apr 06, 2026 - 15:00 euvd

EUVD-2026-19246

Analysis Generated

Apr 06, 2026 - 15:00 vuln.today

CVE Published

Apr 06, 2026 - 14:33 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in 11.0.6.

AnalysisAI

Remote code execution in GLPI asset management software versions 11.0.0 through 11.0.5 allows authenticated administrators to execute arbitrary code via template injection. The vulnerability requires high privileges (administrator access) but enables complete system compromise with changed scope, indicating potential breakout from the application context. CVSS 9.1 (Critical). No public exploit identified at time of analysis, with EPSS data unavailable for this recent CVE. Fixed in version 11.0.6.

Technical ContextAI

GLPI (Gestionnaire Libre de Parc Informatique) is an open-source IT asset management and service desk platform written in PHP. This vulnerability stems from CWE-94 (Improper Control of Generation of Code / Code Injection) within the template rendering system. Template injection vulnerabilities occur when user-controlled input is embedded into template engines without proper sanitization, allowing attackers to inject malicious code that executes server-side. In GLPI's case, administrator-level users can inject code through template fields, which the application then processes and executes. The 'Changed' scope (S:C) in the CVSS vector indicates the vulnerability allows impacts beyond the vulnerable component's security scope, suggesting the template engine runs with elevated privileges or can affect other system components beyond GLPI itself.

RemediationAI

Upgrade to GLPI version 11.0.6 immediately, which contains the fix for this template injection vulnerability. The vendor-released patch addresses the root cause by implementing proper input sanitization and validation in the template processing engine. Organizations should download version 11.0.6 from the official GLPI project repository at https://github.com/glpi-project/glpi and follow standard upgrade procedures including database backup prior to migration. No workarounds are mentioned in the security advisory, making upgrading the only complete remediation path. As an interim risk reduction measure while planning the upgrade, organizations should audit administrator account access, enforce multi-factor authentication for all GLPI administrators, review administrator activity logs for suspicious template modifications, and consider restricting network access to GLPI administrative interfaces to trusted IP ranges only. Detailed security advisory and patch information is available at https://github.com/glpi-project/glpi/security/advisories/GHSA-2c98-648q-h27h.