CVE-2026-71880: GBIF IPT Path Traversal Vulnerability

CVE-2026-71880 Overview

CVE-2026-71880 is a server-side template injection vulnerability in the Global Biodiversity Information Facility (GBIF) Integrated Publishing Toolkit (IPT) versions before 3.3.4. The flaw resides in how the application's template engine interprets untrusted input, enabling remote authenticated attackers to inject template directives. Successful exploitation allows attackers to read server-side files and access internal application state. The vulnerability is classified under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). GBIF IPT is a widely deployed open-source tool used by biodiversity researchers and institutions to publish species and occurrence datasets.

Critical Impact
Authenticated attackers can inject template expressions to disclose sensitive server-side files and leak internal application state, compromising confidentiality and integrity of IPT deployments.

Affected Products

GBIF Integrated Publishing Toolkit versions prior to 3.3.4
Self-hosted IPT instances used by biodiversity data publishers
Institutional deployments exposing IPT administrative interfaces to authenticated users

Discovery Timeline

2026-08-18 - CVE-2026-71880 published to NVD
2026-08-18 - Last updated in NVD database
Mandiant Vulnerability Disclosure - Tracked as MNDT-2026-0016

Technical Details for CVE-2026-71880

Vulnerability Analysis

The vulnerability originates from unsafe handling of user-supplied input inside the IPT template engine. When authenticated users submit input that is passed to the templating layer without proper neutralization, the engine evaluates attacker-controlled template directives as executable expressions rather than literal text. This design flaw enables server-side template injection (SSTI), allowing traversal of internal object graphs exposed to the template context. Attackers with valid credentials can craft payloads that reference file system objects or application beans reachable from the template scope. The result is unauthorized disclosure of server-side files and runtime state, including configuration data that may aid follow-on attacks. Refer to the Mandiant advisory MNDT-2026-0016 for the coordinated disclosure record.

Root Cause

The root cause is interpretation of untrusted input by the template engine, categorized as CWE-1336. Input reaching the template context is neither escaped nor restricted to a safe sandbox, so template metacharacters retain their evaluation semantics. This anti-pattern is common when user-editable fields such as dataset descriptions or resource metadata are rendered through the same engine that processes trusted templates.

Attack Vector

Exploitation requires network access to the IPT web interface and valid low-privilege credentials. An authenticated attacker submits a template injection payload through an input field that is later rendered by the vulnerable engine. Because attack complexity is high, the attacker must identify an injection sink that reaches sensitive contexts. See the upstream GitHub issue tracker for public discussion of the fix.

No verified public proof-of-concept code is available. Consult the Mandiant disclosure for technical details.

Detection Methods for CVE-2026-71880

Indicators of Compromise

Unusual template metacharacters such as ${...}, #{...}, <%...%>, or {{...}} appearing in IPT form submissions, resource metadata fields, or URL parameters
Application log entries showing template evaluation errors, class-loader references, or unexpected file access originating from authenticated user sessions
Outbound requests or file reads from the IPT process referencing paths such as /etc/passwd, application.properties, or IPT configuration directories

Detection Strategies

Instrument the IPT application logs to flag template rendering errors correlated with user-submitted form data
Deploy web application firewall rules that inspect POST bodies and query strings for template expression syntax targeting authenticated IPT endpoints
Baseline normal IPT file access patterns and alert on process reads outside the expected data and configuration directories

Monitoring Recommendations

Audit IPT account activity for unusual dataset edits or metadata changes shortly before anomalous file access
Enable verbose logging on the IPT authentication layer to attribute template injection attempts to specific user accounts
Forward IPT and reverse-proxy logs to a centralized SIEM for correlation with host-level file access telemetry

How to Mitigate CVE-2026-71880

Immediate Actions Required

Upgrade GBIF IPT to version 3.3.4 or later on all production and staging instances
Rotate credentials for any IPT accounts that could have been used to exploit the flaw prior to patching
Review server-side files accessible from the IPT process for signs of unauthorized read access

Patch Information

The vendor released the fix in GBIF IPT 3.3.4. Track the remediation and related discussion in the GBIF IPT GitHub issue #3118. Refer to the official GBIF IPT project page for release downloads and upgrade documentation.

Workarounds

Restrict IPT account creation and require administrative approval for new user registrations until patching is complete
Place the IPT web interface behind a reverse proxy or VPN to limit exposure to authenticated internal users only
Apply web application firewall signatures that block template expression metacharacters in fields where they are not expected

bash

# Verify installed IPT version and plan upgrade to 3.3.4 or later
curl -s https://ipt.example.org/ | grep -Eo 'IPT v[0-9]+\.[0-9]+\.[0-9]+'

# Example WAF rule fragment (ModSecurity) to flag template metacharacters
# in authenticated IPT form submissions
SecRule ARGS "@rx (\$\{|#\{|\{\{|<%)" \
    "id:1071880,phase:2,deny,log,\
     msg:'Possible SSTI attempt against GBIF IPT (CVE-2026-71880)'"