CRITICAL 9.1 NVD
CVE-2026-58256
GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through
GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and permitting remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page. The advisory reports this issue as fixed in version 4.5.0.
References
- https://github.com/JeromeDevome/GRR/commit/3ff9504ae557da1e8e208149acbf8c7f04de645f
- https://github.com/JeromeDevome/GRR/security/advisories/GHSA-fp4f-xmw6-5jf8
- https://github.com/JeromeDevome/GRR/tree/v4.5.0
This critical severity vulnerability with a CVSS score of 9.1 was published on 2026-10-27 via NVD.
Risk Timeline
CVE Disclosed2026-10-27 · 0 days ago
Remediation Resources
vulnfeed aggregates 17800 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.