Remote Code Execution in GLPI Fields Plugin (CVE-2026-23489)

CVE-2026-23489 is a critical security vulnerability affecting the Fields plugin for GLPI, a widely used IT Asset Management and Service Desk platform. The vulnerability is categorized as a blind remote code execution (RCE) flaw residing in the dropdown-generation functionality. It permits an authenticated user with high-level administrative privileges to inject and execute arbitrary PHP code on the underlying server.

Disclosed on August 28, 2026, the vulnerability impacts plugin versions 1.23.2 and earlier. A functional proof-of-concept (PoC) exploit has been released publicly, providing a mechanism to trigger the RCE by manipulating input parameters during the dropdown creation process. Because the exploit requires a valid administrative session cookie, defenders should prioritize patching or restricting access to the administrative interfaces of GLPI instances. Given the high CVSS score of 9.1 and the availability of exploit code, the risk to unpatched environments is elevated.

Attack Chain

1. Attacker gains authenticated access to a GLPI instance with high privileges.
2. Attacker retrieves a valid session cookie for the GLPI instance.
3. Attacker identifies the vulnerable dropdown-generation feature within the Fields plugin.
4. Attacker constructs a malicious request containing arbitrary PHP payload strings injected into the plugin parameters.
5. The server-side application fails to sanitize the input before processing the dropdown configuration.
6. The application executes the attacker-supplied PHP code during the internal generation routine.
7. Attacker achieves remote code execution in the context of the web server user.

Impact

Successful exploitation of CVE-2026-23489 grants an attacker full control over the application server, facilitating unauthorized data exfiltration, modification of service desk records, or lateral movement within the hosting environment. Organizations utilizing GLPI with the Fields plugin are at risk of a complete system compromise. The high severity rating reflects the potential for full confidentiality, integrity, and availability impact on the target asset management infrastructure.

Recommendation

• Update the GLPI Fields plugin to version 1.23.3 or later immediately to remediate the vulnerability associated with CVE-2026-23489.
• Monitor web server access logs for anomalous POST requests directed at GLPI endpoints related to plugin configurations or dropdown generation.
• Audit administrative session activity in GLPI to identify potential unauthorized use of high-privileged accounts.
• Restrict access to the GLPI administrative interface to known-secure management networks to mitigate the impact of compromised or stolen administrative credentials.