Template Injection Vulnerability in GBIF Integrated Publishing Toolkit
CVE-2026-71880

7.6HIGH

Key Information:

Vendor

Gbif

Status
Integrated Publishing Toolkit
Vendor
CVE Published:
18 August 2026

What is CVE-2026-71880?

A vulnerability exists in the GBIF Integrated Publishing Toolkit that enables remote authenticated attackers to leverage template injection flaws. This allows them to potentially access sensitive server-side files and application state, posing serious security risks for users operating versions prior to 3.3.4. Users are advised to update their software to mitigate the risk.

Affected Version(s)

Integrated Publishing Toolkit 0 < 3.3.4

References

https://www.gbif.org/ipt
product
https://github.com/gbif/ipt/issues/3118
patch
https://github.com/mandiant/Vulnerability-Disclosures/blo...
third-party-advisory

CVSS V4

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.