# CVE-2026-11321: pluginsGLPI DataInjection SQL injection in CSV import

Source: https://junglewise.ai/threats/cve-2026-11321-pluginsglpi-datainjection-sql-injection-in-csv-import  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-11321 · Severity: medium · CVSS 6.4 · Published 2026-07-10

The DataInjection plugin for GLPI, an asset management software, contains a security flaw in its CSV import feature. An authorized user could upload a specially crafted file to run unauthorized database commands. This could allow an attacker to steal sensitive information or disrupt the organization's asset tracking operations.

Vendors: [GLPI Project](https://junglewise.ai/threats/vendors/glpi-project).

## Quick answers

**Is CVE-2026-11321 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11321 being exploited in the wild.

**How severe is CVE-2026-11321?** Medium severity, with a CVSS score of 6.4, published 10 July 2026.

**Which products and versions are affected?** GLPI Project DataInjection 2.15.6 (GLPI 11 builds).

**Is there a fix for CVE-2026-11321?** A patch was published on 2026-05-29: Version 2.15.7 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11321 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11321?** Check whether you run GLPI Project DataInjection at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authenticated SQL injection vulnerability exists in the DataInjection plugin for GLPI version 2.15.6. The root cause is the direct concatenation of user-supplied CSV field values into SQL queries during the import process without proper parameterization or escaping. An attacker with high privileges and access to the Data Injection feature can embed malicious SQL expressions, such as SLEEP(), into mapped fields like 'Serial Number'. This allows for time-based blind SQL injection to extract sensitive information from the database. The issue is addressed in version 2.15.7.

## Affected products

- pluginsGLPI DataInjection 2.15.6 (GLPI 11 builds)

## Timeline

- 2026-05-29: patched: Version 2.15.7 released
- 2026-07-10: disclosed: CVE-2026-11321 published

## References

- [https://github.com/pluginsGLPI/datainjection](https://github.com/pluginsGLPI/datainjection)
- [https://github.com/pluginsGLPI/datainjection/releases/tag/2.15.7](https://github.com/pluginsGLPI/datainjection/releases/tag/2.15.7)
- [https://github.com/pluginsGLPI/datainjection/security/advisories/GHSA-57qv-j6r6-pcc4](https://github.com/pluginsGLPI/datainjection/security/advisories/GHSA-57qv-j6r6-pcc4)
- [https://www.vulncheck.com/advisories/glpi-datainjection-plugin-authenticated-sql-injection-via-csv-import](https://www.vulncheck.com/advisories/glpi-datainjection-plugin-authenticated-sql-injection-via-csv-import)