CVE-2021-21406: Combodo Itop

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

Combodo iTop is an open source, web based IT Service Management tool. In versions prior to 2.7.4, there is a command injection vulnerability in the Setup Wizard when providing Graphviz executable path. The vulnerability is patched in version 2.7.4 and 3.0.0.

Affected products

• Combodo Itop: before 2.7.4 (fixed in 2.7.4); version 2.7.5 only; version 2.7.5-1 only

Published 2021-07-21. Last modified 2026-06-17.