GRR: Remote code execution via PHP code injection in LDAP connector
Summary
GRR, a resource management and reservation application, has a code injection flaw in its LDAP connector configuration. An administrator can submit crafted values, such as the ldap_filter parameter, which are written into the PHP file /personnalisation/config_ldap.inc.php. Successful exploitation allows remote code execution on the server. The attacker needs administrator rights, and the administrator must first connect to an attacker-controlled LDAP server before submitting the malicious input.
Affected
- GRR 4.4.2 and earlier (GitHub advisory)
- The CVE record lists versions before 4.5.0 as affected; VulDB describes the range as up to 4.4.x.
Fixed in
- Upgrade to GRR 4.5.0 or later.
Workaround
- No vendor workaround documented.
- Restrict administrator rights to the people who need them.
- Limit access to the administration area to trusted internal networks or VPN.
- Check /personnalisation/config_ldap.inc.php for unexpected PHP code or recent changes.
Exploitation
- Not listed in CISA KEV at the time of research.
- No public proof of concept or exploitation reports found.
- Exploitation in the wild: unknown.
Our recommendation
- Inventory all GRR installations and confirm their versions.
- Upgrade to GRR 4.5.0 or later as a priority.
- Limit the number of administrator accounts and enforce MFA where possible.
- Check the LDAP configuration file for unexpected PHP content and monitor it for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-fp4f-xmw6-5jf8 github.com
- Fix commit 3ff9504 (Sécurisation LDAP) github.com
- GRR release v4.5.0 github.com
- VulDB entry 427589 vuldb.com
- OffSeq threat radar entry CVE-2026-58256 radar.offseq.com
- Strix CVE entry CVE-2026-58256 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:17.
Original description (NVD)
GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and permitting remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page. The advisory reports this issue as fixed in version 4.5.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.