Combodo iTop CVE-2026-33333

Exploitation requires a valid authenticated session with at least low-privilege access to the iTop web interface (PR:L per CVSS vector). The attacker must trigger a server-side PHP exception through the AJAX layer (pages/ajax.render.php), which requires some form of user interaction or intentional request crafting (UI:R per CVSS). No special iTop configuration or feature flag is required beyond the application being reachable over the network - iTop's default installation is affected. Exploitation is limited by the authentication requirement: unauthenticated external actors cannot trigger this path. Additionally, the information yielded is application-internal metadata (paths, schema hints), not credentials or session tokens directly, limiting standalone impact.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N scores 3.5 (Low), consistent with a post-authentication, limited-scope information disclosure. PR:L confirms that only authenticated users can trigger this, significantly narrowing the attacker pool. UI:R suggests that some interactive action is required to induce the error condition. There is no CISA KEV listing and no public proof-of-concept; no public exploit has been identified at time of analysis. Real-world risk is low in isolation: the vulnerability yields reconnaissance value (internal paths, schema hints) rather than direct compromise. The primary concern is chaining - a low-privilege user could harvest disclosed exception details to inform a subsequent, higher-severity attack. Organizations running iTop as an externally accessible portal with broad user bases should prioritize patching over those with internal-only deployments.

An authenticated iTop user with minimal privileges crafts or triggers an AJAX request to pages/ajax.render.php that causes an unhandled PHP exception - for instance, by submitting malformed input to an object manipulation endpoint. Prior to 3.2.3, the raw exception message is returned in the HTTP response, potentially revealing internal file system paths, class names, or database query fragments. The attacker collects these details to map the application internals and inform further exploitation attempts. No public proof-of-concept exists at time of analysis.