CVE-2026-26026: Glpi-project GLPI RCE Vulnerability

CVE-2026-26026 Overview

CVE-2026-26026 is a template injection vulnerability affecting GLPI, a widely-used free asset and IT management software package. This vulnerability allows an authenticated administrator to exploit template injection flaws to achieve Remote Code Execution (RCE) on the affected system. The vulnerability exists in GLPI versions from 11.0.0 to before 11.0.6.

Critical Impact

Authenticated administrators can exploit template injection to execute arbitrary code on the server, potentially leading to complete system compromise, data exfiltration, and lateral movement within the network.

Affected Products

• GLPI versions 11.0.0 through 11.0.5
• glpi-project glpi

Discovery Timeline

• 2026-04-06 - CVE-2026-26026 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-26026

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code), commonly known as Code Injection. The flaw resides in GLPI's template processing functionality where user-controlled input is insufficiently sanitized before being interpreted by the template engine. When an administrator with access to template configuration features injects malicious template directives, these are processed by the server-side template engine without proper validation, resulting in arbitrary code execution.

The attack requires high privileges (administrator access) but can be exploited remotely over the network without user interaction. Successful exploitation grants the attacker the same privileges as the GLPI web application process, typically allowing read/write access to the application's data and configuration, as well as potential access to underlying system resources.

Root Cause

The root cause of CVE-2026-26026 lies in improper handling of template syntax within GLPI's template engine. The application fails to adequately sanitize or restrict template expressions that administrators can input, allowing the injection of code that the template engine interprets and executes. This is a Server-Side Template Injection (SSTI) vulnerability where the template engine processes attacker-controlled data as code rather than as plain text content.

Attack Vector

The attack vector for this vulnerability is network-based, requiring an attacker to have authenticated administrator-level access to the GLPI application. The exploitation flow involves:

1. The attacker authenticates to the GLPI instance with administrator credentials
2. The attacker navigates to a functionality that processes templates
3. Malicious template injection payloads are crafted and submitted
4. The template engine processes the malicious input, executing arbitrary code on the server
5. The attacker gains code execution in the context of the web application

Server-Side Template Injection attacks typically involve injecting template syntax specific to the underlying template engine. The exact payload depends on which template engine GLPI uses, but common techniques include accessing internal objects, invoking methods, and breaking out of sandbox restrictions to execute system commands.

For detailed technical information about the exploitation mechanism, refer to the GLPI Security Advisory.

Detection Methods for CVE-2026-26026

Indicators of Compromise

• Unusual template modifications or configurations in GLPI administrative logs
• Unexpected outbound network connections from the GLPI server
• New or modified files in GLPI's web directories or temporary folders
• Anomalous process spawning from the web server process (e.g., www-data or apache)
• Evidence of command execution in web server error logs

Detection Strategies

• Monitor GLPI administrative actions for template-related configuration changes
• Implement web application firewall (WAF) rules to detect common SSTI payloads
• Review authentication logs for unusual administrator login patterns or access from unexpected IP addresses
• Deploy file integrity monitoring on critical GLPI directories to detect unauthorized modifications

Monitoring Recommendations

• Enable comprehensive audit logging within GLPI for all administrative actions
• Configure SIEM rules to alert on template injection signature patterns in web server logs
• Monitor process creation events on the GLPI server for anomalous child processes of the web server
• Implement network monitoring to detect unusual outbound connections from the GLPI infrastructure

How to Mitigate CVE-2026-26026

Immediate Actions Required

• Upgrade GLPI to version 11.0.6 or later immediately
• Audit administrator accounts and remove unnecessary privileged access
• Review recent administrative activity logs for suspicious template modifications
• Implement network segmentation to limit the impact of potential compromise
• Consider temporarily restricting access to administrative template functionality until patching is complete

Patch Information

The GLPI project has released version 11.0.6 which addresses this vulnerability. Organizations should prioritize upgrading to this version to remediate CVE-2026-26026. Detailed patch information and release notes are available in the GitHub Security Advisory.

Workarounds

• Restrict administrator access to only trusted personnel with verified need
• Implement strict network access controls limiting who can reach the GLPI administrative interface
• Deploy a Web Application Firewall (WAF) with rules to detect and block template injection attempts
• Monitor and alert on any template-related configuration changes until patching is completed

# Example: Restrict access to GLPI admin panel via Apache configuration
<Location /glpi/front/config.php>
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>