{"id":"CVE-2026-115981","kind":"vulnerability","aliases":["CVE-2026-115981"],"related":[],"title":"phpIPAM: REQUEST_URI handling in upgrade page allows cross-site scripting","description":"A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality of the file upgrade/index.php. Such manipulation of the argument REQUEST_URI leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.","summary":"phpIPAM up to 1.8.3 mishandles the REQUEST_URI argument in upgrade/index.php, so a crafted URL can inject script into the page. An attacker who gets a user to open that link can run script in the victim's session.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","phpipam","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed phpIPAM version against the `1.8.3` upper bound in the advisory\n- Confirm whether the `upgrade/` directory is reachable on the web server","fix":"- unknown","status":"open","published_at":"2026-10-24T22:16:27+00:00","first_seen_at":"2026-10-24T22:46:00+00:00","triaged_at":"2026-10-25T04:45:45+00:00","updated_at":"2026-10-25T04:45:45+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:45:45Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"phpIPAM: REQUEST_URI handling in upgrade page allows cross-site scripting","impact":"low","summary":"phpIPAM up to 1.8.3 mishandles the REQUEST_URI argument in upgrade/index.php, so a crafted URL can inject script into the page. An attacker who gets a user to open that link can run script in the victim's session.","category":"package","nicknames":[],"who_cares":["phpIPAM","self-hosted","php"],"confidence":0.5,"needs_auth":"unknown","worst_case":"script runs in a user's browser session on the phpIPAM site","analyst_note":"Find the vendor fix version and whether upgrade/index.php is reachable post-install; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115981.","how_to_check":"- Check the installed phpIPAM version against the `1.8.3` upper bound in the advisory\n- Confirm whether the `upgrade/` directory is reachable on the web server","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Installations of phpIPAM at version 1.8.3 or earlier that serve the upgrade page to users are exposed. Instances where the upgrade directory is removed or blocked after installation are less exposed. The sources do not name a fixed version.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000589,"input_tokens":3335,"output_tokens":512,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-115981':15A,18A '-2026':14A,17A '1.8.3':28B,74C 'affect':75C 'allow':8A 'argument':33B,91C 'attack':47B,100C 'contact':118C 'craft':38B 'cross':10A,96C 'cross-sit':9A 'cve':13A,16A 'detect':69C 'disclos':109C 'disclosur':122C 'earli':119C 'exploit':106C 'file':85C 'function':82C 'get':49B 'handl':4A 'host':24B 'inject':41B 'launch':103C 'lead':94C 'link':55B 'manipul':88C 'may':101C,112C 'mishandl':29B 'open':53B 'packag':19B 'page':7A,45B 'php':20B 'phpipam':1A,21B,25B,71C 'public':110C 'remot':104C 'request':2A,31B,92C 'run':57B 'script':12A,42B,58B,98C 'secur':65C 'self':23B 'self-host':22B 'session':63B 'site':11A,97C 'unknown':81C 'upgrad':6A 'upgrade/index.php':35B,86C 'uri':3A,32B,93C 'url':39B 'use':114C 'user':51B 'vendor':116C 'victim':61B 'vulner':66C,78C","nicknames":[],"mitigations":[],"who_affected":"Installations of phpIPAM at version 1.8.3 or earlier that serve the upgrade page to users are exposed. Instances where the upgrade directory is removed or blocked after installation are less exposed. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T22:16:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115981","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115981","severity":null,"published_at":"2026-10-24T22:16:27+00:00","modified_at":"2026-10-24T22:16:27+00:00","first_seen_at":"2026-10-24T22:46:00+00:00","fetched_at":"2026-10-24T22:46:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}