CVE-2026-26001

HIGH

GLPI Inventory Plugin has SQL Injection on dropdown_calendar Report

Title source: cna

Description

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, non sanitized user input can lend to an SQL injection from reports, with adequate rights. This vulnerability is fixed in 1.6.6.

References (1)

Core 1

Core References

X_Refsource_Confirm x_refsource_confirm

https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-gp4r-m42c-wvgx

Scores

CVSS v3 7.1

EPSS 0.0005

EPSS Percentile 15.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-89

Status published

Products (1)

glpi-project/glpi-inventory-plugin < 1.6.6

Published Mar 18, 2026

Tracked Since Mar 18, 2026