CVE-2026-23489

Fields GLPI plugin vulnerable to RCE in dropdown generation

State: Published
Severity: 9.1 Critical
Published: Mar 16, 2026
Updated: Mar 16, 2026
Reserved: Jan 13, 2026

Description

Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
fieldspluginsGLPI	< 1.23.3Affected

References

https://github.com/pluginsGLPI/fields/security/advisories/GHSA-rj7q-mmx9-fhq7
https://github.com/pluginsGLPI/fields/releases/tag/1.23.3

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.