CVE-2026-115981 in phpIPAM
Summary
by MITRE • 10/25/2026
A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality of the file upgrade/index.php. Such manipulation of the argument REQUEST_URI leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/25/2026
The phpIPAM software, a popular open-source IP address management tool, contains a critical security flaw in versions up to 1.8.3 that allows for remote cross-site scripting attacks. This vulnerability resides within the upgrade/index.php file and is triggered by improper handling of the REQUEST_URI HTTP header parameter. The core technical issue stems from insufficient input validation and sanitization mechanisms when processing this specific argument. Because the application fails to adequately escape special characters or neutralize script payloads embedded within the URI, malicious actors can inject executable JavaScript code that gets reflected back in the browser context of any user who accesses a crafted URL containing the exploit payload.
This flaw is classified under CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting or XSS. The vulnerability enables attackers to execute arbitrary scripts in the victim's web browser, potentially leading to session hijacking, credential theft, defacement of the application interface, or redirection to malicious sites. Since phpIPAM is often used by network administrators and IT operations teams who require high availability and trust in their management tools, a successful exploitation could compromise sensitive network topology data, IP allocation records, and user authentication sessions stored within cookies or local storage mechanisms associated with the web session.
The attack vector for this vulnerability is remote, meaning it does not require prior authentication to be exploited if the upgrade functionality remains accessible without strict access controls in certain configurations. The exploit has been publicly disclosed, which significantly increases the risk landscape as automated scanning tools and malicious actors can readily leverage known proof-of-concept code against vulnerable instances. This public availability of exploits lowers the barrier for entry, allowing less sophisticated attackers to compromise systems that have not yet applied vendor-provided patches or implemented compensating controls.
Mitigation strategies should focus on immediate patching by upgrading phpIPAM to version 1.8.4 or later where this issue has been addressed through improved input validation and output encoding practices. In environments where an upgrade is not immediately feasible, administrators can implement web application firewall rules to detect and block requests containing suspicious patterns in the REQUEST_URI parameter that resemble script injection attempts. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact of any successful XSS execution by restricting the sources from which scripts are allowed to load or execute within the browser context. Regular security audits and penetration testing should be conducted to ensure no other similar input handling flaws exist in custom modules or third-party integrations associated with the platform.