CVE-2026-39975
Combodo iTop: Remote code execution using external auth variable value
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions. This issue has been fixed in version 3.2.3.
| CWE | CWE-94 |
| Vendor | combodo |
| Product | itop |
| Published | Aug 24, 2026 |
| Last Updated | Aug 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for combodo itop
Be the first to know when new unknown vulnerabilities affecting combodo itop are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Combodo / iTop
< 3.2.3