CVE-2026-39975 in iTop
Summary
by MITRE • 08/24/2026
Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions. This issue has been fixed in version 3.2.3.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified in Combodo i versions prior to 3.2.3 represents a critical failure in access control mechanisms that allows unauthenticated attackers to compromise the integrity of the application environment. Combodo iTop is a widely deployed web-based IT service management platform used by organizations to manage their IT infrastructure, assets, and services. The security flaw centers on the improper handling of the .readonly file, which serves as a critical configuration marker within the installation directory structure. This specific file is generated during the initial setup process and functions as a safeguard mechanism designed to prevent unauthorized or accidental write operations to sensitive application files once the system has been initialized for production use.
The technical root cause of this vulnerability lies in insufficient input validation and authorization checks when processing requests related to file management operations within the iTop web interface. An unauthenticated user, without needing valid credentials or any form of authentication token, was able to send a crafted HTTP request that targeted the deletion routine associated with the .readonly file. Because the application failed to verify whether the requester had administrative privileges before executing the delete command on this specific protected resource, it allowed external actors to remove the safeguard entirely. This lack of proper access control enforcement is a classic example of an insecure direct object reference combined with broken authentication principles, where the system trusts client-side inputs or session states that have not been properly validated against server-side security policies.
The operational impact of removing the .readonly file is severe and directly leads to remote code execution capabilities for the attacker. Once this protective marker is deleted, the application's internal logic reverts to allowing write operations on files that were previously locked down. This effectively opens up critical configuration files and potentially executable scripts within the web root or related directories to modification by any user interacting with the interface. An attacker can exploit this state of unrestricted file writing to inject malicious code into these writable locations, such as modifying PHP include files or uploading backdoors disguised as legitimate assets. By manipulating these files, the attacker gains the ability to execute arbitrary commands on the underlying server hosting the iTop instance, potentially leading to full system compromise, data exfiltration, and lateral movement within the network infrastructure.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-434 Unrestricted Upload of File with Dangerous Type if considered in the context of subsequent exploitation steps involving file uploads facilitated by the removed restriction. In terms of adversary behavior mapping under the MITRE ATT&CK framework, this flaw facilitates Initial Access through web application vulnerabilities and enables Execution via arbitrary code execution on compromised hosts. The absence of authentication requirements for such a destructive action highlights a significant gap in the security architecture, particularly regarding how sensitive administrative functions are exposed to unverified actors.
To mitigate this risk, organizations running Combodo iTop must immediately upgrade to version 3.2.3 or later, where the developers have implemented proper authorization checks to ensure that only authenticated administrators with appropriate roles can modify or delete system-critical files like .readonly. In environments where upgrading is not immediately feasible, temporary mitigations should include restricting direct access to the installation directory through web server configuration rules and ensuring that no unauthenticated users have any level of interaction with the application interface if possible. Regular security audits focusing on file permission settings and strict adherence to principle of least privilege for all administrative endpoints are essential practices to prevent similar vulnerabilities in future deployments or other software components within the IT service management stack.