CVE-2026-23489: Teclib-edition Fields RCE Vulnerability

CVE-2026-23489 Overview

CVE-2026-23489 is a critical arbitrary code execution vulnerability in the Fields plugin for GLPI (Gestionnaire Libre de Parc Informatique), an open-source IT asset management software. The Fields plugin allows users to add custom fields on GLPI item forms. Prior to version 1.23.3, users with permissions to create dropdowns can exploit this vulnerability to execute arbitrary PHP code on the server, potentially leading to complete system compromise.

Critical Impact

This vulnerability allows authenticated users with dropdown creation privileges to execute arbitrary PHP code on the server, potentially leading to full system compromise, data theft, and lateral movement within the network.

Affected Products

• Teclib-edition Fields plugin versions prior to 1.23.3
• GLPI installations using the vulnerable Fields plugin
• All systems running unpatched Fields plugin configurations

Discovery Timeline

• 2026-03-16 - CVE CVE-2026-23489 published to NVD
• 2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-23489

Vulnerability Analysis

This vulnerability is classified under CWE-20 (Improper Input Validation), which indicates that the Fields plugin fails to properly validate or sanitize user-supplied input when processing dropdown creation requests. The flaw allows authenticated users with dropdown creation privileges to inject malicious PHP code that is subsequently executed by the server.

The attack can be performed remotely over the network and requires high privileges (dropdown creation access). However, once exploited, the attacker can affect resources beyond the vulnerable component's scope, making it particularly dangerous in enterprise environments where GLPI manages critical IT infrastructure data.

Root Cause

The root cause of this vulnerability stems from improper input validation in the dropdown creation functionality of the Fields plugin. When users with dropdown creation permissions submit field definitions, the plugin does not adequately sanitize the input before processing it as PHP code. This allows malicious PHP payloads to be injected and executed within the context of the web application server, bypassing expected security boundaries.

Attack Vector

The attack is network-based and can be executed by any authenticated user who has been granted permission to create dropdown fields in GLPI. The attacker crafts a specially designed request containing malicious PHP code within dropdown field parameters. When the server processes this request, the injected code is executed with the privileges of the web server process.

This attack vector is particularly concerning because:

• Organizations often grant dropdown creation privileges to IT staff for customization purposes
• The attack does not require user interaction once the attacker has appropriate access
• Successful exploitation can lead to cross-scope impact, affecting other applications and systems on the same server

Detection Methods for CVE-2026-23489

Indicators of Compromise

• Unusual PHP process execution patterns originating from the GLPI web application directory
• Unexpected outbound network connections from the GLPI server
• Modified or newly created files in the GLPI plugin directories
• Anomalous dropdown field configurations containing encoded or obfuscated content

Detection Strategies

• Monitor web application logs for suspicious POST requests to Fields plugin endpoints with unusual payload sizes or encoding
• Implement file integrity monitoring on the GLPI installation directory to detect unauthorized modifications
• Review audit logs for dropdown creation activities by users, particularly those with elevated privileges
• Deploy web application firewall (WAF) rules to detect PHP code injection patterns in request bodies

Monitoring Recommendations

• Enable verbose logging on the GLPI application and review logs for anomalous dropdown-related activities
• Configure endpoint detection and response (EDR) solutions to monitor for PHP code execution anomalies
• Implement network traffic analysis to identify suspicious data exfiltration attempts from the GLPI server
• Set up alerts for any modifications to the Fields plugin configuration files

How to Mitigate CVE-2026-23489

Immediate Actions Required

• Upgrade the Fields plugin to version 1.23.3 or later immediately
• Review and restrict dropdown creation privileges to only essential personnel
• Audit existing dropdown configurations for any suspicious or unexpected content
• Implement network segmentation to limit potential lateral movement from compromised GLPI servers

Patch Information

The vulnerability has been addressed in Fields plugin version 1.23.3. Organizations should download and apply this patch from the official GitHub release. For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-rj7q-mmx9-fhq7.

Workarounds

• Temporarily disable the Fields plugin if upgrading is not immediately possible
• Restrict dropdown creation permissions to administrative accounts only until the patch can be applied
• Implement web application firewall rules to block requests containing PHP code patterns to the Fields plugin endpoints
• Consider placing the GLPI server behind a reverse proxy with strict input validation rules

# Example: Restrict plugin access in Apache configuration (temporary workaround)
<Directory "/var/www/glpi/plugins/fields">
    # Restrict access to administrative IPs only
    Require ip 10.0.0.0/8 192.168.1.0/24
</Directory>