CVE-2026-71880
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit before version 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection.
Risk Assessment
The risk includes potential disclosure of sensitive server data and manipulation of application state, which could lead to confidentiality and integrity breaches.
Recommendation
It is recommended to update GBIF Integrated Publishing Toolkit to version 3.3.4 or later, which includes the fix.
Other vulnerabilities in GBIF Integrated Publishing Toolkit
See all- CVE-2026-71879Critical
Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass.
- CVE-2026-71878Critical
Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass.
Original NVD description (English source)
Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection
Vulnerability data from NVD (NIST) · CISA KEV · EPSS