CVE-2026-26001 — GLPI Inventory Plugin has SQL Injection on dropdown_calendar Report

CVE-2026-26001

GLPI Inventory Plugin has SQL Injection on dropdown_calendar Report PUBLISHED

Description (CNA)

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, non sanitized user input can lend to an SQL injection from reports, with adequate rights. This vulnerability is fixed in 1.6.6.

Affected (CNA)

Vendor / product	Versions
glpi-project / glpi-inventory-plugin	affected < 1.6.6

CWE

CWE-89

References

https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-gp4r-m42c-wvgx

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.