CVE-2026-58256

critical · 9.1

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and permitting remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page. The advisory reports this issue as fixed in version 4.5.0.

9.1

CVSS

—

EPSS (exploit prob.)

—

EPSS percentile

2026-10-27

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-94

References

https://github.com/JeromeDevome/GRR/commit/3ff9504ae557da1e8e208149acbf8c7f04de645f
https://github.com/JeromeDevome/GRR/security/advisories/GHSA-fp4f-xmw6-5jf8
https://github.com/JeromeDevome/GRR/tree/v4.5.0

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-58256