CVE-2026-58256: GRR vulnerable to Remote Code Execution Via PHP Code Injection
GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as ldapfilter, poisoning /personnalisation/configldap.inc.php and permitting remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page. The advisory reports this issue as fixed in version 4.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GRRto a version that resolves this vulnerability.Fixed in 4.5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated GRR administrator is required. The administrator must be able to configure an LDAP connector and successfully connect to an LDAP server; that server may be attacker-controlled.
Which configurations are exposed?
The affected workflow is LDAP connector configuration, specifically parameters such as ldap_filter. Deployments that do not use or allow administrative LDAP connector configuration are not described as exposed by the advisory.
What is the practical exploitation path?
After successfully connecting to an LDAP server, the administrator submits malicious input on the subsequent connector settings page. The input is written into /personnalisation/config_ldap.inc.php, where injected PHP can enable remote code execution.
What version addresses the issue?
The advisory reports the issue as fixed in GRR version 4.5.0. Versions before 4.5.0 are described as vulnerable.