CVE-2026-23489: 
NixOS vulnerability analysis and mitigation

CVE-2026-23489 is a remote code execution (RCE) vulnerability in the Fields plugin for GLPI, a popular open-source IT asset management and helpdesk platform. The flaw allows authenticated users with dropdown creation privileges to execute arbitrary PHP code on the affected system. All versions of the Fields plugin prior to 1.23.3 are affected. The vulnerability was disclosed on March 16, 2026, and patched in version 1.23.3. It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE-20) in the dropdown generation functionality of the Fields plugin. When a privileged user creates a dropdown, user-supplied input is not adequately sanitized before being processed, allowing PHP code to be injected and executed server-side. The attack vector is network-based, requires high privileges (dropdown creation permission), no user interaction, and has a changed scope — meaning successful exploitation can impact resources beyond the plugin itself. The vulnerability was reported by the researcher "login-securite" and is tracked under GitHub Security Advisory GHSA-rj7q-mmx9-fhq7 (GitHub Advisory).

Successful exploitation grants an attacker arbitrary PHP code execution on the GLPI server, resulting in high impact to confidentiality, integrity, and availability. An attacker could exfiltrate sensitive IT asset and helpdesk data, modify system configurations or data, deploy web shells for persistent access, and potentially pivot to other systems on the network. The changed scope in the CVSS rating indicates that the impact extends beyond the Fields plugin itself to the underlying host and connected infrastructure (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.123%, reflecting a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with dropdown creation privileges, which limits the attack surface but does not eliminate risk in environments with multiple privileged users.

1. Reconnaissance: Identify GLPI instances running the Fields plugin at versions prior to 1.23.3 by examining exposed GLPI web interfaces or plugin version disclosures.
2. Obtain privileged credentials: Acquire or compromise an account with permissions to create dropdowns within the Fields plugin (e.g., a GLPI administrator or a user with delegated dropdown creation rights).
3. Navigate to dropdown creation: Log in to the GLPI interface and access the Fields plugin's dropdown management section.
4. Inject malicious PHP payload: When creating or editing a dropdown, supply a crafted input containing arbitrary PHP code (e.g., a PHP web shell or command execution payload) in a field that is insufficiently validated before server-side processing.
5. Trigger code execution: Submit the dropdown creation form; the server processes the unsanitized input and executes the injected PHP code, granting the attacker remote code execution on the GLPI host (GitHub Advisory).

• Logs: GLPI application logs showing dropdown creation events by unexpected or low-activity accounts; PHP error logs containing unusual eval or code execution traces originating from the Fields plugin.
• File System: Unexpected PHP files (web shells) written to the GLPI plugin directory (e.g., /glpi/plugins/fields/) or other web-accessible directories; modification timestamps on plugin files inconsistent with the last legitimate update.
• Process: Unusual child processes spawned by the web server process (e.g., Apache/Nginx/PHP-FPM) such as bash, curl, wget, or python; unexpected outbound network connections from the GLPI server.
• Network: Outbound connections from the GLPI server to unknown external IPs, particularly on non-standard ports; unusual data exfiltration patterns in network traffic logs.

The primary remediation is to upgrade the Fields plugin to version 1.23.3 or later, which patches this vulnerability (GitHub Release). As an interim measure, organizations should restrict dropdown creation permissions to only essential, trusted administrative accounts and audit existing dropdown entries for suspicious PHP code patterns. Additionally, implementing network segmentation to limit access to GLPI systems from untrusted networks reduces exposure. Organizations should also monitor GLPI systems for unexpected code execution or file system changes following the patch.

The vulnerability received coverage from The Hacker Wire and was noted in security community feeds shortly after disclosure (The Hacker Wire). Discussion was observed on Mastodon/Infosec.exchange and Bluesky, reflecting moderate community interest given the critical CVSS score. No major vendor statements beyond the GitHub security advisory have been identified.