Threats affecting pkg:github/glpi-project/glpi-inventory-plugin

CVE-2026-26001 is a high-severity SQL injection vulnerability in the GLPI Inventory Plugin versions prior to 1.6.6. It arises from improper sanitization of user input in report generation functionality, allowing attackers with adequate privileges to inject malicious SQL commands. Exploitation requires network access and privileges but no user interaction, potentially leading to unauthorized data disclosure and partial data integrity compromise. The vulnerability does not impact availability and has no known exploits in the wild as of now. The issue is fixed in version 1.6.6 of the plugin. Organizations using affected versions should prioritize upgrading to mitigate risk.

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, there is a reflected XSS vulnerability in task jobs. This vulnerability is fixed in 1.6.6.

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Versions 1.5.0 and below are vulnerable to SQL Injection. This issue is fixed in version 1.5.1.