CVE-2026-58256 Details
Description
GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and permitting remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page. The advisory reports this issue as fixed in version 4.5.0.
A remote code execution vulnerability has been identified in the GRR resource management application, prior to version 4.5.0. The issue arises from the ability of an administrator to inject malicious PHP code through LDAP connector configuration parameters, such as 'ldap_filter'. This injected code poisons the 'config_ldap.inc.php' file, allowing for remote code execution. To exploit this vulnerability, an administrator must successfully connect to an attacker-controlled LDAP server and then submit malicious input through the connector settings page.
Users should update GRR to version 4.5.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/JeromeDevome/GRR/commit/3ff9504ae557da1e8e208149acbf8c7f04de645f | [email protected] | Source CodeVendor |
| https://github.com/JeromeDevome/GRR/security/advisories/GHSA-fp4f-xmw6-5jf8 | [email protected] | AdvisoryRemedyVendor |
| https://github.com/JeromeDevome/GRR/tree/v4.5.0 | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GRR | <= 4.4.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |