Vulnerability · Published Jul 10, 2026 · Assigned by VulnCheck

CVE-2026-11321GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import

Medium 6.4

In plain English

A medium-severity SQL injection in datainjection from pluginsGLPI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.4%top 63.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with access to the Data injection feature can embed SQL expressions such as SLEEP() in a mapped field (for example Serial Number) to manipulate the generated query and extract database information via time-based blind injection.

Affected products (as reported)

Vendor	Product	Versions
pluginsGLPI	datainjection	2.15.6 – before 2.15.7

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-57qv-j6r6-pcc4) vendor-advisory
DataInjection 2.15.7 Release patch
Product product
https://www.vulncheck.com/advisories/glpi-datainjection-plugin-authenticated-sql-injection-via-csv-import third-party-advisory