High · 7.6 CVE-2026-71880 EUVD-2026-61140GHSA-xf73-gxc6-65vv

Server-side template injection in Integrated Publishing Toolkit

Published Aug 18, 2026 · Updated Aug 18, 2026 · Assigned by Mandiant

Vendor: GBIF Product: Integrated Publishing Toolkit

Description

Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection

Affected products

Vendor	Product	Affected	Fixed
GBIF	Integrated Publishing Toolkit	< 3.3.4	3.3.4

References

https://www.gbif.org/ipt product
https://github.com/gbif/ipt/issues/3118 patch
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0016.md third-party-advisory