Injection Vulnerabilities in GBIF Integrated Publishing Toolkit

CVE-2026-71881

What is CVE-2026-71881?

The GBIF Integrated Publishing Toolkit has notable multiple injection vulnerabilities that affect resource metadata fields. These vulnerabilities can be exploited by authenticated remote attackers, allowing them to execute code within another user’s session post-user interaction. The exploitation occurs through stored cross-site scripting, creating a pathway for malicious actions within the application context. It is crucial for users to update to version 3.3.5 or higher to mitigate these risks. Further technical details and remediation steps can be found in official patch reports and security advisories.

References