CVE-2026-23489

Published: Mar 16, 2026Modified: Mar 18, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Exploitability: 2.3 / Impact: 6.0

Source: security-advisories@github.com (Secondary)

Description

Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.

Affected (1)

Products: Teclib Edition: Fields

Teclib Edition

1 product

Fields

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Teclib Edition Fields	Before 1.23.3

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://github.com/pluginsGLPI/fields/releases/tag/1.23.3

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/pluginsGLPI/fields/security/advisories/GHSA-rj7q-mmx9-fhq7

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.