CVE Intelligence
Analysis AI-assisted

CVE-2026-26263: GLPI Unauthenticated SQL Injection in Search Engine

GLPI versions from 11.0.0 up to before 11.0.6 contain an unauthenticated time-based blind SQL injection in the Search engine, classified as CWE-89. The vendor advisory states the issue is fixed in 11.0.6, and NVD rates it critical with a 9.8 score. The sources consulted do not show confirmed exploitation in the wild.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

GLPI is a free asset and IT management software package. This record describes an unauthenticated time-based blind SQL injection in its Search engine, affecting versions from 11.0.0 up to before 11.0.6. The weakness is categorized as CWE-89 (SQL Injection). The record states that the issue is fixed in 11.0.6.

Impact

  • The NVD vector records high impact on confidentiality, integrity and availability, with no privileges and no user interaction required.
  • NVD scores the issue at 9.8 (critical). GitHub's entry in the record lists 8.1.
  • SSVC data in the record indicates total technical impact and that the issue is not automatable.

Affected products and versions

  • Product: GLPI (Glpi-project Glpi).
  • Affected range: from 11.0.0 up to before 11.0.6.
  • Fixed version: 11.0.6, according to the description in the record.
  • The record's structured fixes list is empty, so administrators should confirm the fix through the vendor advisory linked below.

Exploitation status

CISA KEV does not list this CVE in the record, so no active exploitation can be confirmed from the KEV catalog. No confirmed exploitation appears in the sources consulted. EPSS gives a probability of 0.004 with a percentile of 0.33083, and the SSVC exploitation field is none.

Remediation and mitigation

  • Upgrade GLPI to version 11.0.6 or later, following the GitHub security advisory.
  • Prioritize this update on internet-exposed or widely accessible GLPI instances, given the unauthenticated nature of the flaw.
  • If an immediate upgrade is not possible, limit network access to the GLPI instance to trusted users and networks, pending the update.

Detection guidance

  • Review web server and application logs for unusual volumes or patterns of requests to search functionality, especially from unauthenticated sources.
  • Watch for unexpected increases in response times on search pages, which can accompany time-based blind injection activity.
  • Correlate these signals with database performance metrics and alert on anomalies.

Limitations of the available information

  • The record does not include public proof-of-concept availability, and no exploitation details are provided here by design.
  • The structured fixes list is empty, so the fixed version comes only from the description and the vendor advisory.
  • NVD and GitHub assign different CVSS scores (9.8 and 8.1), and the reason for the difference is not stated in the record.
  • The exact search endpoints affected are not identified in the record.

Sources: GitHub advisory, NVD entry.

Frequently asked questions

Which GLPI versions are affected by CVE-2026-26263?

The record lists versions from 11.0.0 up to before 11.0.6 as affected.

What is the fixed version?

The record states that the issue is fixed in 11.0.6, and the vendor advisory is the reference to confirm the fix.

Is this vulnerability being actively exploited?

CISA KEV does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.