CVE-2026-58256

CVSS 9.1 (critical) · published 2026-10-27

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and permitting remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page. The advisory reports this issue as fixed in version 4.5.0.

Weakness: CWE-94

Source: NVD CVE-2026-58256

References

• https://github.com/JeromeDevome/GRR/commit/3ff9504ae557da1e8e208149acbf8c7f04de645f
• https://github.com/JeromeDevome/GRR/security/advisories/GHSA-fp4f-xmw6-5jf8
• https://github.com/JeromeDevome/GRR/tree/v4.5.0

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.