CVE-2026-71880: Server-side template injection in Integrated Publishing Toolkit

Severity: high (CVSS 7.6 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-18 · updated 2026-10-22
Weakness: CWE-1336

Description

Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection

Affected products

GBIF Integrated Publishing Toolkit: before 3.3.4 — fixed in 3.3.4

How to fix

Upgrade to a fixed version: GBIF Integrated Publishing Toolkit 3.3.4. Check the vendor advisory for mitigations.

References

https://github.com/gbif/ipt/issues/3118
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0016.md
https://www.gbif.org/ipt

Get alerted when CVE-2026-71880 or the next vulnerability affects your stack