CVE-2026-23489 Fields GLPI plugin vulnerable to RCE in dropdown generation
An attacker with dropdown creation privileges can execute arbitrary PHP code in the Fields plugin for GLPI.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-23489?
CVE-2026-23489 is a critical code injection vulnerability in pluginsGLPI fields, published on 16 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.
Weakness: CWE-20
Which versions are affected by CVE-2026-23489?
It affects 1 product.
Products include Teclib-Edition Fields.
How do I fix CVE-2026-23489?
No fix has been published for CVE-2026-23489 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-23489 being exploited?
There is no known exploitation of CVE-2026-23489 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in pluginsGLPI fields
Sources
Also known as GHSA-rj7q-mmx9-fhq7.