{"id":"CVE-2026-58256","kind":"vulnerability","aliases":["CVE-2026-58256"],"related":[],"title":"GRR reservation app: admin LDAP settings let attackers run PHP code","description":"GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and permitting remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page. The advisory reports this issue as fixed in version 4.5.0.","summary":"GRR, a resource reservation application, writes LDAP connector settings such as ldap_filter into a PHP config file without sanitizing them. An administrator can inject PHP that the server then executes, giving remote code execution on the host.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["grr","ldap","package","php","self-hosted"],"not_affected_if":["fixed-version","no-ldap-connector"],"how_to_check":"- Check the installed GRR version in its release metadata or repository tag; versions before `4.5.0` are listed as affected.\n- Look at `/personnalisation/config_ldap.inc.php` for PHP code inside LDAP filter or other connector values that you did not write.","fix":"- Upgrade GRR to `4.5.0` or later, per the advisory.\n- Review LDAP connector settings and the `config_ldap.inc.php` file for injected code, and rotate any credentials the server could read if it was tampered with.","status":"open","published_at":"2026-10-27T23:17:06+00:00","first_seen_at":"2026-10-27T23:29:44+00:00","triaged_at":"2026-10-27T23:31:15+00:00","updated_at":"2026-10-27T23:31:15+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T23:31:15Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GRR to `4.5.0` or later, per the advisory.\n- Review LDAP connector settings and the `config_ldap.inc.php` file for injected code, and rotate any credentials the server could read if it was tampered with.","reach":"network","title":"GRR reservation app: admin LDAP settings let attackers run PHP code","impact":"high","summary":"GRR, a resource reservation application, writes LDAP connector settings such as ldap_filter into a PHP config file without sanitizing them. An administrator can inject PHP that the server then executes, giving remote code execution on the host.","category":"package","nicknames":[],"who_cares":["grr","php","self-hosted","ldap"],"confidence":0.7,"needs_auth":"yes","worst_case":"Code runs on the server through injected PHP in config file","analyst_note":"Confirm the exact affected version range and the advisory's own link; the sources only give the fixed version 4.5.0.","how_to_check":"- Check the installed GRR version in its release metadata or repository tag; versions before `4.5.0` are listed as affected.\n- Look at `/personnalisation/config_ldap.inc.php` for PHP code inside LDAP filter or other connector values that you did not write.","needs_analyst":true,"not_affected_if":["fixed-version","no-ldap-connector"],"who_is_affected":"Installations of GRR before the advisory-reported fixed version 4.5.0 that use the LDAP connector are exposed. Exploitation requires an administrator account, and the sources say the admin must connect to an LDAP server, which may be attacker-controlled. Teams not running GRR, or running 4.5.0 or later, can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000644,"input_tokens":3371,"output_tokens":614,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-58256':14A,17A '/personnalisation/config_ldap.inc.php':96C '4.5.0':79C,138C 'admin':4A 'administr':47B,81C,103C 'advisori':75C,130C 'advisory-report':74C 'app':3A 'applic':29B,70C 'attack':8A,116C 'attacker-control':115C 'code':11A,58B,100C 'config':41B 'configur':89C 'connect':107C 'connector':32B,88C,126C 'control':117C 'cve':12A,15A 'execut':55B,59B,101C 'file':42B 'filter':37B,94C 'first':105C 'fix':77C,135C 'give':56B 'grr':1A,18B,25B,63C 'host':24B,62B 'inject':49B,83C 'input':122C 'issu':133C 'ldap':5A,19B,31B,36B,87C,93C,110C 'let':7A 'malici':84C,121C 'manag':67C 'must':104C 'packag':20B 'page':128C 'paramet':90C 'permit':98C 'php':10A,21B,40B,50B,85C 'poison':95C 'prior':71C 'remot':57B,99C 'report':76C,131C 'reserv':2A,28B,69C 'resourc':27B,66C 'run':9A 'sanit':44B 'self':23B 'self-host':22B 'server':53B,111C 'set':6A,33B,127C 'submit':120C 'subsequ':125C 'success':106C 'version':78C,137C 'without':43B 'write':30B","nicknames":[],"mitigations":[],"who_affected":"Installations of GRR before the advisory-reported fixed version 4.5.0 that use the LDAP connector are exposed. Exploitation requires an administrator account, and the sources say the admin must connect to an LDAP server, which may be attacker-controlled. Teams not running GRR, or running 4.5.0 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T23:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58256","severity":null,"published_at":"2026-10-27T23:17:06+00:00","modified_at":"2026-10-27T23:17:06+00:00","first_seen_at":"2026-10-27T23:29:44+00:00","fetched_at":"2026-10-27T23:29:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}