CVE-2026-26026: Critical RCE in GLPI via Template Injection

GLPI, an open source IT asset management software, is affected by vulnerability CVE-2026-26026: a template injection flaw that, when exploited by a user with administrator privileges, leads to remote code execution (RCE). The issue affects versions from 11.0.0 to those prior to 11.0.6, according to the official NVD description.

The vulnerability has a CVSS score of 9.1, classified as critical in the available data. It was published on NVD on April 6, 2026, and has already been fixed in version 11.0.6. A public GitHub repository exists claiming to contain source code comparison material and local lab files related to this CVE for versions 11.0.5 and 11.0.6: this is a signal of community technical interest, not proof of a functioning public exploit or active exploitation in the wild, which remains unconfirmed by the available data.

For teams managing GLPI installations, the priority is to verify the version in use and update to 11.0.6 or later as soon as possible, given the critical severity and RCE nature of the flaw. It is also advisable to review who holds administrator privileges on the platform, since exploitation requires that access level, and to monitor administrative logs for any anomalies in template configurations.