CVE-2026-39975
CriticalCVSS 9.4Summary
Combodo iTop is a web-based IT service management tool. Prior to version 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions.
Risk Assessment
A remote attacker without authentication can delete the .readonly file, enabling code execution and potential takeover of the iTop instance.
Recommendation
Update Combodo iTop to version 3.2.3 or later, which contains the fix.
Original NVD description (English source)
Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions. This issue has been fixed in version 3.2.3.