CVE-2026-26263: 
GLPI vulnerability analysis and mitigation

CVE-2026-26263 is an unauthenticated time-based blind SQL injection vulnerability in GLPI's Search engine, a free asset and IT management software package. It affects GLPI versions 11.0.0 through 11.0.5 and was fixed in version 11.0.6. The vulnerability was published on April 6, 2026, with the security advisory credited to researchers BZHunt and aarjubh. It carries a CVSS v3.1 base score of 9.8 (Critical) per NVD, and 8.1 (High) per the GitHub Security Advisory (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning GLPI's Search engine fails to properly sanitize or parameterize user-supplied input before incorporating it into SQL queries. Because the injection is time-based and blind, an attacker cannot directly read query output but can infer database contents by measuring server response delays. Critically, the vulnerable Search endpoint is accessible without authentication, and the GitHub advisory notes that the attack surface is widened when anonymous FAQ access is enabled. No user interaction is required, and the attack is conducted entirely over the network (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to extract sensitive data from the GLPI database — including user credentials, asset inventory, and IT management records — as well as modify or delete database contents. The vulnerability has high impacts on confidentiality, integrity, and availability, meaning an attacker could fully compromise the GLPI database without any prior access. Given GLPI's role as an IT asset management platform, exploitation could expose sensitive organizational infrastructure data and facilitate further lateral movement within the environment (GitHub Advisory, Feedly).

As of the time of reporting, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.031% (0.000310), indicating a currently low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Nessus plugin 305617 (Tenable).

1. Reconnaissance: Identify internet-facing GLPI instances running versions 11.0.0–11.0.5 using search engines like Shodan or Censys, or by checking the GLPI version disclosure on the login or FAQ page.
2. Identify vulnerable endpoint: Locate the GLPI Search engine endpoint (e.g., /glpi/front/search.php or similar search-related routes) that is accessible without authentication, particularly when anonymous FAQ access is enabled.
3. Craft time-based blind SQL injection payload: Construct an HTTP request to the search endpoint with a malicious parameter containing a time-based SQL injection payload (e.g., using SLEEP() or BENCHMARK() in MySQL) to confirm the injection point by observing delayed server responses.
4. Enumerate database: Use automated tools such as sqlmap with time-based blind technique (--technique=T) to systematically extract database schema, table names, and sensitive data (e.g., user credentials, configuration data) by measuring response timing differences.
5. Exfiltrate or manipulate data: Leverage the confirmed injection to dump sensitive records (e.g., hashed passwords, asset data) or issue data modification/deletion queries against the GLPI database (GitHub Advisory).

• Network: Unusual or high-volume HTTP requests to GLPI search endpoints (e.g., /front/search.php) from unexpected source IPs, particularly with abnormally long query strings or repeated requests with slight parameter variations.
• Logs: Web server access logs showing requests to search endpoints with SQL-related keywords or encoded payloads (e.g., SLEEP, BENCHMARK, WAITFOR, %27, %3B) in query parameters; requests resulting in unusually long response times.
• Database: Database slow query logs showing repeated time-delay functions (SLEEP(), BENCHMARK()) being executed; unexpected SELECT queries against sensitive tables (e.g., glpi_users, glpi_configs).
• Application: GLPI application logs showing repeated search queries from unauthenticated sessions with anomalous parameter values.

The primary remediation is to upgrade GLPI to version 11.0.6 or later, which contains the fix for this vulnerability (GitHub Advisory). As a temporary workaround, administrators should disable anonymous access to the FAQ, which restricts exploitation to authenticated users only and significantly reduces the attack surface. Additionally, deploying a Web Application Firewall (WAF) with SQL injection detection rules targeting the GLPI search functionality and restricting network access to the GLPI application to trusted IP ranges are recommended interim measures (Feedly).

The vulnerability was reported by security researchers BZHunt and aarjubh and disclosed via GitHub's security advisory program (GitHub Advisory). Community discussion was observed on Bluesky and tracked by multiple vulnerability aggregators including VulDB, CIRCL, and Tenable shortly after disclosure. No major vendor statements beyond the official GLPI advisory or significant media coverage have been identified at this time.