CVE-2026-39975: Combodo iTop RCE Vulnerability

CVE-2026-39975 Overview

CVE-2026-39975 affects Combodo iTop, a web-based IT service management (ITSM) platform. Unauthenticated attackers can delete the .readonly file on iTop instances prior to version 3.2.3. The .readonly file is created during setup and blocks users from performing write actions. Removing this file enables write operations and leads to code execution [CWE-94]. Combodo addressed the issue in iTop version 3.2.3.

Critical Impact
Unauthenticated network attackers can remove a security control file and achieve code execution on affected iTop instances.

Affected Products

Combodo iTop versions prior to 3.2.3
Combodo iTop 3.x branch instances without the 3.2.3 patch
Self-hosted iTop deployments exposed to untrusted networks

Discovery Timeline

2026-08-24 - CVE-2026-39975 published to the National Vulnerability Database (NVD)
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-39975

Vulnerability Analysis

Combodo iTop uses a .readonly marker file to enforce a read-only state on the application. The file is written during the setup process and instructs the application to reject write actions from authenticated users. The vulnerability allows an unauthenticated remote user to delete this file over the network. Once the marker is removed, the application accepts write operations that were previously blocked. Attackers can chain the resulting write capability with iTop functionality to execute arbitrary code on the server. The weakness is classified under CWE-94: Improper Control of Generation of Code.

Root Cause

The root cause is missing authentication and authorization on the code path that deletes the .readonly file. The application exposes a network-reachable action that removes a security-relevant configuration artifact without verifying the caller. This design flaw allows any anonymous requester to disable the read-only guard that protects write-sensitive functionality.

Attack Vector

The attack vector is remote and unauthenticated over HTTP or HTTPS. An attacker sends a request to an exposed iTop endpoint to delete the .readonly file. After the file is removed, the attacker interacts with iTop features that previously enforced the read-only state. The resulting write access is leveraged to achieve code execution on the underlying host. See the Combodo iTop Security Advisory GHSA-h823-537c-xwfh for details.

No verified public exploit code is available. The vulnerability mechanism is described in prose above; refer to the vendor advisory for technical specifics.

Detection Methods for CVE-2026-39975

Indicators of Compromise

Absence of the .readonly file in the iTop installation directory on an instance that was previously configured with it
Unauthenticated HTTP requests to iTop endpoints associated with configuration or setup actions
Unexpected write activity, object creation, or configuration changes in iTop after periods of anonymous access
New or modified PHP files under the iTop web root that do not correspond to a documented upgrade

Detection Strategies

Monitor file system events for deletion of the .readonly marker under the iTop installation path
Inspect web server access logs for anonymous requests to iTop setup or maintenance URLs
Alert on iTop application logs showing state transitions from read-only to writable outside change windows
Compare deployed iTop file hashes against a known-good baseline from version 3.2.3

Monitoring Recommendations

Enable verbose HTTP logging on the reverse proxy or web server fronting iTop
Forward iTop application, PHP, and web server logs to a centralized analytics platform for correlation
Track process creation on the iTop host, focusing on php, php-fpm, and shell child processes
Baseline outbound network connections from the iTop server and alert on deviations

How to Mitigate CVE-2026-39975

Immediate Actions Required

Upgrade Combodo iTop to version 3.2.3 or later on all instances
Restrict network access to iTop administrative and setup endpoints using a firewall or reverse proxy allowlist
Audit the iTop installation for missing .readonly files and unexpected changes to application files
Rotate credentials and API tokens stored in or accessed by iTop if compromise is suspected

Patch Information

Combodo fixed the vulnerability in iTop 3.2.3. Administrators should apply this release across all affected environments. Full remediation guidance is available in the Combodo iTop Security Advisory GHSA-h823-537c-xwfh.

Workarounds

Place iTop behind an authenticating reverse proxy that blocks anonymous access to setup and maintenance paths
Enforce web server access control lists to restrict iTop administration to trusted management networks
Set restrictive file system permissions on the iTop directory so the web server user cannot delete the .readonly file
Monitor and automatically restore the .readonly file if it is removed outside authorized change windows

bash

# Example: restrict deletion of the .readonly file at the OS level (Linux)
# Replace /var/www/itop with the actual iTop installation path
sudo chown root:root /var/www/itop/.readonly
sudo chmod 0444 /var/www/itop/.readonly
sudo chattr +i /var/www/itop/.readonly