What’s Vulnerable › Vulnerabilities
CVE-2026-26001: GLPI Inventory Plugin has SQL Injection on dropdown_calendar Report
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-18 · updated 2026-06-17
- Weakness: CWE-89
Description
The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, non sanitized user input can lend to an SQL injection from reports, with adequate rights. This vulnerability is fixed in 1.6.6.
Affected products
- glpi-project glpi-inventory-plugin: before 1.6.6 — fixed in 1.6.6
How to fix
Upgrade to a fixed version: glpi-project glpi-inventory-plugin 1.6.6. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-26001 or the next vulnerability affects your stack