Read the docs
TI-2026-09772 Aliases CVE-2026-11321GHSA-q93h-qc46-87rr

GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import

Priority LOW 34CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with access to the Data injection feature can embed SQL expressions such as SLEEP() in a mapped field (for example Serial Number) to manipulate the generated query and extract database information via time-based blind injection.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00423 36th percentileScored 2026-11-07
Fix Fixed datainjection (pluginsGLPI): 2.15.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pluginsGLPIdatainjection2.15.6 to before 2.15.72.15.7Patch availableCNA
  • datainjection VendorpluginsGLPI Affected 2.15.6 to before 2.15.7 Fixed in 2.15.7 Patch available CNA

Remediation

  • Fix · CNA datainjection (pluginsGLPI) Fixed in 2.15.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-11321
  2. 2026-10-03 Alias added: GHSA-q93h-qc46-87rr

References

Patch 1

Advisory 1

Other 1

  • TI-2024-36046 The Addressing GLPI plugin allows data enumeration through uncontrolled object instantiation CVSS 3.1HIGH 8.2
  • TI-2026-38943 Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering CVSS 4.0HIGH 7.3
  • TI-2025-20010 Escalade GLPI Plugin Vulnerable to Improper Access Control CVSS 3.1MEDIUM 6.5
  • TI-2024-30621 Fields GLPI plugin has an Authenticated SQL Injection CVSS 3.1HIGH 7.7
  • TI-2025-40221 GLPI Database Inventory Plugin Vulnerable to Stored Object Injection CVSS 3.1MEDIUM 6.4
  • TI-2025-33324 pluginsGLPI's Database Inventory Plugin allows any authenticated user to send agent requests CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences