High severity · published Mar 17, 2026
CVE-2026-26001
GLPI Inventory Plugin has SQL Injection on dropdown_calendar Report
8.8
CVSS
0.2%
EPSS
No
On KEV
Description
The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, non sanitized user input can lend to an SQL injection from reports, with adequate rights. This vulnerability is fixed in 1.6.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
glpi-inventory-plugin · glpi-project
< 1.6.6 · source: vendor
GI
Glpi Inventory · Glpi-project
before 1.6.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-26001
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-26001
Vendor Advisory
https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-gp4r-m42c-wvgx
More from glpi-inventory-plugin
8.2
CVE-2025-27147
GLPI Inventory plugin has Improper Access Control Vulnerability
7.5
CVE-2025-32786
GLPI Inventory Plugin is Vulnerable to Unauthenticated SQL Injection
6.5
CVE-2025-26626
GLPI Inventory Plugin vulnerable to reflective Cross-site Scripting
6.1
CVE-2026-25590
GLPI Inventory Plugin has Reflected XSS in task jobs