CVE-2026-26001HIGH 8.8EPSS p11.4%

CVE-2026-26001CVE-2026-26001

Description

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, non sanitized user input can lend to an SQL injection from reports, with adequate rights. This vulnerability is fixed in 1.6.6.

Scoring

CVSS 3.18.8 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS0.21% probability of exploitation · percentile 11.4% · 2026-06-18T12:00:27Z
Published2026-03-18
Last modified2026-03-23

Underlying weaknesses· 1

CWE-89

References

  1. https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-gp4r-m42c-wvgx

1

TypeTargetConfidenceTier
WeaknessImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')cwe-890%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-66417
CVE
CVE-2026-29047
CVE
CVE-2025-21619
CVE
CVE-2025-24799
CVE
CVE-2026-22044
CVE
CVE-2026-25936
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.