What is the CVSS score of CVE-2026-26263?

CVE-2026-26263 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Glpi are affected by CVE-2026-26263?

GLPI versions 11.0.0-11.0.5 contain an unauthenticated remote SQL injection vulnerability in the Search engine that allows attackers to extract sensitive database contents without credentials.. A patch is available.

How to fix or mitigate CVE-2026-26263?

Within 24 hours: Identify all GLPI instances in your environment and confirm versions (11.0.0-11.0.5 are vulnerable). Within 7 days: Apply vendor patch to upgrade affected GLPI installations to version 11.0.6 or later. Within 30 days: Conduct database audit to detect unauthorized access attempts or data extraction during the exposure window; review GLPI access logs for exploitation indicators.

Glpi CVE-2026-26263

EUVD-2026-19248 HIGH

SQL Injection (CWE-89)

2026-04-06 GitHub_M

SQLi Glpi Glpi Project

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:06 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

11.0.6

EUVD ID Assigned

Apr 06, 2026 - 15:00 euvd

EUVD-2026-19248

Analysis Generated

Apr 06, 2026 - 15:00 vuln.today

CVE Published

Apr 06, 2026 - 14:36 nvd

HIGH 8.1

DescriptionGitHub Advisory

GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based blind SQL injection exists in GLPI's Search engine. This vulnerability is fixed in 11.0.6.

AnalysisAI

Time-based blind SQL injection in GLPI's Search engine allows remote unauthenticated attackers to extract sensitive database contents and potentially achieve code execution. GLPI versions 11.0.0 through 11.0.5 are vulnerable. The CVSS vector (PR:N) confirms no authentication required, though attack complexity is rated high (AC:H). EPSS data not available, no CISA KEV listing indicates no confirmed active exploitation at time of analysis, but the unauthenticated remote attack surface and SQL injection nature present significant risk for this widely-deployed IT asset management platform.

Technical ContextAI

GLPI (Gestionnaire Libre de Parc Informatique) is an open-source IT asset management, helpdesk, and service management solution used by organizations to track hardware, software, and network resources. This vulnerability (CWE-89: SQL Injection) exists in the Search engine component, a core feature used to query and filter asset data. Time-based blind SQL injection exploits database response delays to infer data content when direct error messages or output are not available. Attackers inject malicious SQL statements that cause conditional time delays, allowing them to extract database contents character-by-character through timing analysis. The affected CPE (cpe:2.3:a:glpi-project:glpi) identifies the GLPI Project's asset management software as the vulnerable product, with versions 11.0.0 through 11.0.5 confirmed vulnerable.

RemediationAI

Upgrade immediately to GLPI version 11.0.6, which contains fixes for this SQL injection vulnerability. Organizations should prioritize patching internet-facing GLPI instances and those accessible from untrusted networks. Download the patched version from the official GLPI Project repository or through established update channels. After upgrading, review access logs for suspicious search queries with unusual timing patterns or excessive repeated requests that may indicate exploitation attempts. As an interim mitigation if immediate patching is not feasible, restrict network access to GLPI Search functionality using firewall rules or web application firewall policies to limit exposure to trusted networks only, though this is not a substitute for patching. Complete vendor advisory and technical details are available at https://github.com/glpi-project/glpi/security/advisories/GHSA-346p-qj3v-9rxj.