CVE-2026-23489

critical · 9.1

Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.

9.1

CVSS

0.3%

EPSS (exploit prob.)

23rd

EPSS percentile

2026-03-16

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-20

Affected products

Vendor	Product	Affected versions
teclib-edition	fields	< 1.23.3

Check a specific version with /api/v1/cve/match.

References

https://github.com/pluginsGLPI/fields/releases/tag/1.23.3
https://github.com/pluginsGLPI/fields/security/advisories/GHSA-rj7q-mmx9-fhq7

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-23489