CVE-2026-11321

GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import

Published Jul 10, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Description

The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with access to the Data injection feature can embed SQL expressions such as SLEEP() in a mapped field (for example Serial Number) to manipulate the generated query and extract database information via time-based blind injection.

Analysis

Technical impact

The DataInjection plugin for GLPI concatenates user‑supplied CSV field values directly into SQL queries during import without parameterization or escaping. This flaw, classified as CWE‑89, enables an authenticated attacker with access to the CSV import feature to inject SQL expressions such as SLEEP(), allowing time‑based blind extraction of database data. The impact is loss of confidentiality.

Affected Systems

The vulnerability exists in the DataInjection plugin version 2.15.6 for GLPI 11 builds. Users with Import permission in GLPI who can access the DataInjection plugin are affected. No other product versions are currently listed.

Risk and Exploitability

The CVSS score is 7.1, indicating moderate to high severity. The EPSS score is <1%, indicating a very low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is through an authenticated CSV import; only users with sufficient privileges can trigger the injection. The lack of public exploitation data suggests the risk is currently theoretical but could be realized by insiders or compromised accounts.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

pluginsGLPI

datainjection

affected

Version	Status	Constraints
`2.15.6`	affected	< 2.15.7

No data.

Vendor Product Versions

Pluginsglpi

Datainjection

Version	Status	Scheme	Platform
`[2.15.6,2.15.7)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the DataInjection plugin to version 2.15.7 or later, which includes a fix for the SQL injection issue during CSV import.
Restrict the Import privilege to trusted administrators only; remove CSV import rights for users who do not require them.
Temporarily disable the DataInjection plugin or the CSV import feature via the GLPI plugin settings until the upgrade is applied, to prevent exploitation.

Generated by OpenCVE AI on July 31, 2026 at 12:58 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements Present

User Interaction Active

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.423% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/pluginsGLPI/datainjection
https://github.com/pluginsGLPI/datainjection/releases/tag/2.15.7
https://github.com/pluginsGLPI/datainjection/security/advisories/GHSA-57qv-j6r6-pcc4
https://www.vulncheck.com/advisories/glpi-datainjection-plugin-authenticated-sql-injection-via-csv-import

History

Jul 14, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 13, 2026 3:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Pluginsglpi Pluginsglpi datainjection
Vendors & Products		Pluginsglpi Pluginsglpi datainjection

Jul 10, 2026 7:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with access to the Data injection feature can embed SQL expressions such as SLEEP() in a mapped field (for example Serial Number) to manipulate the generated query and extract database information via time-based blind injection.
Title		GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import
Weaknesses		CWE-89
References		https://github.com/pluginsGLPI/datainjection https://github.com/pluginsGLPI/datainjection/releases/tag/2.15.7 https://github.com/pluginsGLPI/datainjection/security/advisories/GHSA-57qv-j6r6-pcc4 https://www.vulncheck.com/advisories/glpi-datainjection-plugin-authenticated-sql-injection-via-csv-import
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`