Medium severity · published Jul 10, 2026
CVE-2026-11321
GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import
6.4
CVSS
0.4%
EPSS
No
On KEV
Description
The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with access to the Data injection feature can embed SQL expressions such as SLEEP() in a mapped field (for example Serial Number) to manipulate the generated query and extract database information via time-based blind injection.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
datainjection · pluginsGLPI
2.15.6 before 2.15.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11321
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11321
github.com
https://github.com/pluginsGLPI/datainjection
github.com
https://github.com/pluginsGLPI/datainjection/releases/tag/2.15.7
github.com
https://github.com/pluginsGLPI/datainjection/security/advisories/GHSA-57qv-j6r6-pcc4
www.vulncheck.com
https://www.vulncheck.com/advisories/glpi-datainjection-plugin-authenticated-sql-injection-via-csv-import