Which versions of PHP are affected by CVE-2026-3107?

Teampass password manager versions before 3.1.5.16 contain a critical stored cross-site scripting vulnerability in the password import function that allows unauthenticated attackers to inject…. A patch is available.

How to fix or mitigate CVE-2026-3107?

Within 24 hours: Identify all Teampass deployments and document current versions in use. Within 7 days: Upgrade all Teampass instances to version 3.1.5.16 or later per vendor advisory; disable password import functionality on affected versions if upgrade is not immediately feasible. Within 30 days: Conduct post-upgrade verification testing; audit password import logs for suspicious activity; reset credentials for all administrative accounts as a precautionary measure.

PHP CVE-2026-3107

Q: What is the CVSS score of CVE-2026-3107?

CVE-2026-3107 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17347 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-03-31 INCIBE

GHSA-65q8-p76v-6qj6

XSS PHP

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 09:15 euvd

EUVD-2026-17347

Analysis Generated

Mar 31, 2026 - 09:15 vuln.today

Patch released

Mar 31, 2026 - 09:15 nvd

Patch available

CVE Published

Mar 31, 2026 - 08:58 nvd

CRITICAL 9.3

DescriptionCVE.org

Stored Cross-Site Scripting (XSS) in Teampass versions prior to 3.1.5.16, affecting the password manager's password import functionality at the endpoint 'redacted/index.php?page=items'. The application fails to properly sanitize and encode user-input data during the import process, allowing malicious JavaScript payloads to be persistently stored in the database. When other users view the imported passwords, the payload is automatically executed in their browsers, resulting in a stored XSS condition at the endpoint 'redacted/index.php?page=items'. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code in the context of multiple users and the administrator, which can lead to session hijacking, credential theft, privilege abuse, and compromise of application integrity.

AnalysisAI

Stored cross-site scripting in Teampass password manager versions before 3.1.5.16 enables unauthenticated remote attackers to inject malicious JavaScript through the password import functionality, achieving persistent code execution in victims' browsers including administrators. CVSS 9.3 (Critical) with EPSS data unavailable, no KEV listing, and patch available per vendor advisory. Attack requires no authentication (PR:N) and low complexity (AC:L), creating significant risk for organizational password compromise and lateral movement.

Technical ContextAI

Teampass is an open-source collaborative password manager written in PHP, designed for team-based credential storage and sharing. This vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) affects the password import module at the items endpoint. The application fails to implement proper input sanitization and output encoding when processing imported password data, allowing JavaScript payloads to be stored directly in the backend database. When rendered in other users' browsers during password viewing operations, the stored payload executes without additional interaction, creating a persistent XSS condition. The affected product per CPE data is cpe:2.3:a:teampass:teampass:*:*:*:*:*:*:*:* covering all versions prior to 3.1.5.16. The PHP-based architecture and collaborative nature of the application amplify impact, as a single malicious import can compromise multiple users accessing shared credentials.

RemediationAI

Organizations must immediately upgrade Teampass to version 3.1.5.16 or later, which contains vendor-released patches addressing this stored XSS vulnerability. The official security advisory and patch information is available from INCIBE at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-teampass. During the upgrade window, implement emergency mitigations by restricting access to the password import functionality (index.php?page=items endpoint) through web application firewall rules or authentication layer controls, limiting this capability only to highly trusted administrators. Conduct immediate forensic review of existing password entries imported since last known-good baseline to identify and remove potential stored XSS payloads-search database records for JavaScript event handlers, script tags, and HTML encoding anomalies. After patching, force password rotation for all credentials stored in Teampass and invalidate all active user sessions to prevent exploitation of potentially compromised session tokens. Review application access logs for suspicious import operations preceding the patch deployment, particularly imports from previously unused accounts or containing unusually large payloads.