GBIF IPT CVE-2026-71880

Exploitation requires a valid authenticated session on the target GBIF IPT instance with at least low-privilege access (CVSS PR:L confirmed); anonymous or unauthenticated exploitation is not possible. The vulnerability is reachable over the network (AV:N) with no user interaction required beyond the attacker's own session. Exploitation complexity is rated high (AC:H), meaning the attacker must identify the correct template engine syntax and craft payloads accordingly - blind or fully automated exploitation is less reliable. No special non-default configuration is described as a prerequisite; standard IPT deployments before 3.3.4 are in scope. What limits exploitation: the mandatory authenticated session (not open to anonymous internet users), the high exploitation complexity requiring payload knowledge specific to IPT's template engine, and the absence of confirmed scope change or availability impact (VA:N), restricting the realistic attack outcome to server-side file reads and internal state disclosure rather than full system compromise or denial of service.

The CVSS 4.0 score of 7.6 reflects serious confidentiality and integrity risk to the vulnerable system (VC:H/VI:H), with no availability impact (VA:N) and no confirmed scope change to subsequent systems (SC:N/SI:N/SA:N). The AC:H rating is a meaningful dampener - exploitation is not trivial, as the attacker must identify and craft payloads specific to the underlying template engine used by IPT, reducing the likelihood of automated or opportunistic mass exploitation. PR:L confirms that a registered authenticated session is required, restricting the attacker pool to users who can obtain credentials through registration, phishing, or credential reuse. No EPSS score was included in the available data, so exploitation probability cannot be independently quantified; the absence of a KEV listing and no confirmed public exploit code at time of analysis suggests this has not yet seen widespread active exploitation. Even a mid-sized research institution or municipal environmental agency in inowroclaw managing biodiversity data through a public-facing IPT instance should treat this as a meaningful upgrade priority given the risk of sensitive configuration file exposure. The primary data gap is the missing EPSS signal and the absence of independently confirmed patch release details beyond the version boundary stated in the description.

An attacker obtains or registers a low-privilege account on a publicly accessible GBIF IPT instance, then submits a crafted template expression (such as a Freemarker or Velocity payload) into a user-controlled field that is subsequently evaluated server-side. The template engine processes the injected directive and returns the contents of sensitive server-side files - such as database configuration files or application properties containing credentials - directly to the attacker. The AC:H rating indicates the attacker likely requires experimentation with payload variants to identify the specific template engine syntax and bypass any partial input filtering before achieving successful file read.