CVE-2026-42224: Icinga Ipl-Web

High severity, CVSS 7.6. EPSS: 0.5% chance of exploitation in the next 30 days.

ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the vulnerability allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. The victim needs to visit a specifically prepared website and may have no immediate chance to notice any wrongdoing. This issue has been patched in versions 0.13.1 and 0.10.3.

Affected products

• Icinga Ipl-Web: from 0.11.0, before 0.13.1 (fixed in 0.13.1); before 0.10.3 (fixed in 0.10.3)

Published 2026-05-08. Last modified 2026-06-17.