CVE-2026-26026
CRITICALGLPI 11.0.0-11.0.5 Templates - Admin Remote Code Execution
Title source: manualExploitation Summary
EIP tracks 2 public exploits for CVE-2026-26026. PoCs published by adminlove520, CEAarab.
AI-analyzed exploit summary This script exploits an authenticated RCE vulnerability in GLPI by leveraging a CSRF token to authenticate as 'glpi/glpi' and then injecting a command via the 'shell_exec' function through a crafted AJAX request. The output is parsed from the response to confirm execution.
Description
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in 11.0.6.
Exploits (2)
This script exploits an authenticated RCE vulnerability in GLPI by leveraging a CSRF token to authenticate as 'glpi/glpi' and then injecting a command via the 'shell_exec' function through a crafted AJAX request. The output is parsed from the response to confirm execution.
This script exploits an authenticated RCE vulnerability in GLPI by leveraging a CSRF token to authenticate as 'glpi/glpi' and then injecting a command via the 'shell_exec' function through a crafted AJAX request. The output is parsed from the response to confirm execution.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H