Fields is a GLPI plugin used to add custom fields to GLPI item forms. This vulnerability allows an attacker with permission to create dropdowns to execute arbitrary PHP code on the GLPI server. As a result, the attacker can gain full control of the GLPI instance, compromising confidentiality, integrity, and availability. The weakness is an input validation flaw (CWE-20).

The vulnerability affects the GLPI Fields plugin version 1.23.2 and earlier. Any instance of the plugin used before the 1.23.3 release is susceptible.

The CVSS score of 9.1 indicates a high severity Remote Code Execution capability. The EPSS score of <1% suggests that public exploitation is currently uncommon but still possible. The vulnerability is not listed in the CISA KEV collection. An attacker would need permission to create dropdowns in the plugin, which is typically restricted to administrators or trusted users. Once authorized, the attacker can supply malicious input during dropdown creation to trigger code execution.