Is CVE-2026-115982 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115982 being exploited in the wild.

How severe is CVE-2026-115982?

Medium severity, with a CVSS score of 4.3, published 24 October 2026.

Is there a fix for CVE-2026-115982?

No fixed version is recorded yet. Validate that the deviceid parameter is numeric using is_numeric() and apply HTML escaping via escape_input() before inserting it into HTML attributes. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-115982 attacked?

It is attacked over the network.

Am I affected by CVE-2026-115982?

Check whether you run Phpipam at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115982: phpIPAM reflected cross-site scripting in rack link creation

CVE-2026-115982 · Severity: medium · CVSS 4.3 · Published 2026-10-24

phpIPAM is an IP address management tool used by organizations to track and manage network infrastructure. A reflected XSS vulnerability in the rack management feature allows attackers to inject malicious JavaScript by crafting a specially-crafted link. When an authenticated administrator visits the link, the attacker can steal session credentials, expose sensitive data, or perform unauthorized actions within the phpIPAM system.

Technologies: Phpipam. Vendors: Phpipam.

Quick answers

Is CVE-2026-115982 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115982 being exploited in the wild.
How severe is CVE-2026-115982?: Medium severity, with a CVSS score of 4.3, published 24 October 2026.
Which products and versions are affected?: Phpipam up to 1.8.3.
Is there a fix for CVE-2026-115982?: No fixed version is recorded yet. Validate that the deviceid parameter is numeric using is_numeric() and apply HTML escaping via escape_input() before inserting it into HTML attributes. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-115982 attacked?: It is attacked over the network.
Am I affected by CVE-2026-115982?: Check whether you run Phpipam at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Validate that the deviceid parameter is numeric using is_numeric() and apply HTML escaping via escape_input() before inserting it into HTML attributes.

Technical details

The vulnerability exists in app/tools/racks/show-rack-popup.php where the deviceid POST parameter is insufficiently sanitized before being reflected into an HTML img src attribute. Although strip_tags() removes HTML tags, double quotes and event handlers are preserved, allowing injection of JavaScript code. An attacker can craft a POST request with a malicious payload that executes in the browser context of an authenticated admin user, enabling session hijacking or unauthorized actions.

Affected products

phpIPAM phpIPAM up to 1.8.3

Timeline

2026-10-24: disclosed: Vulnerability published via GitHub Gist and CVE-2026-115982
2025-09-17: other: Maintainer confirmed fix will be included in next release

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.