CVE-2026-40877

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-40877

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40877.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-40877

Aliases

GHSA-3mq5-p5vh-cw7r

Published

2026-08-24T18:57:55.017Z

Modified

2026-08-28T03:30:32.623398564Z

Severity

8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator

Summary

Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences

Details

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3.

Database specific

{
    "cwe_ids": [
        "CWE-502",
        "CWE-94"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40877.json"
}

References

Affected packages

Git / github.com/combodo/itop

Affected ranges

Type

GIT

Repo

https://github.com/combodo/itop

Events

Introduced

Fixed

33a51b47bf58b1a02803c81a8c7ec005d1935845

Database specific

Show details

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.2.3"
        }
    ]
}

Affected versions

2.*

2.7.0-alpha1

2.7.0-beta

2.7.0-beta2

3.*

3.1.0-alpha1

3.2.0-alpha1

3.2.0-rc1

3.2.0-rc2

3.2.0-rc3

3.2.1

3.2.2

ITSM_Designer_3.*

ITSM_Designer_3.1-compatibility

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40877.json"