CVE-2026-71880: Server-side template injection in Integrated Publishing Toolkit
Published Aug 18, 2026
·Updated
Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection
Affected Software
1 affected component
GBIF Integrated Publishing Toolkit<3.3.4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GBIF Integrated Publishing Toolkitto a version that resolves this vulnerability.Fixed in 3.3.4
Event History
Aug 18, 2026
CVE Published
via MITRE·05:56 PM
Data Sourced
via MITRE·05:56 PM
DescriptionWeakness
Frequently Asked Questions
1
Which deployments are exposed?
GBIF Integrated Publishing Toolkit installations running a version earlier than 3.3.4 are affected. The issue is exploitable remotely, but the attacker must be authenticated.
2
What does an attacker need, and what can they access?
An authenticated attacker can cause untrusted input to be interpreted by the template engine. This can provide access to server-side files and application state.