CVE-2026-58256
GRR is a resource management and reservation application
- Risk score
- 55/100
- CVSS
- 9.1 v3.1
- Published
- 27 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as ldap_filter, poisoning /personnalisation/config_ldap.inc.php and permitting remote code execution. The administ…
- Affected
- See advisory
- Fix
- Upgrade the product to 4.5.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 9.1 critical
References
Original description
GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and permitting remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page. The advisory reports this issue as fixed in version 4.5.0.
Last activity 27 Oct 2026. Patch Forecast updates every hour.