CVE-2026-58256

Summary

A PHP code injection vulnerability (CWE-94) in GRR's LDAP connector configuration allows an authenticated administrator to inject malicious PHP code via parameters like `ldap_filter`, which gets written to `config_ldap.inc.php` and enables remote code execution.

Exploitability

Exploitation requires an attacker who already has administrator privileges, can connect to a (possibly attacker-controlled) LDAP server, and submits malicious input on the connector settings page after successful LDAP bind.

Blast radius

Successful exploitation grants full remote code execution with the privileges of the web application, compromising confidentiality, integrity, and availability of the affected system.

Detection

Defenders may observe anomalous writes to `/personnalisation/config_ldap.inc.php` containing PHP code (e.g., `<?php`, `eval(`, `system(`) in file system logs or web application audit logs; additionally, unexpected outbound LDAP connections to untrusted or newly configured servers may be visible in network logs.

Prioritized remediation

Upgrade to GRR version 4.5.0 or later, where the vulnerability is fixed.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.