Open-source business platforms week 44 2026: unauthenticated SQL injection and code execution lead 39 advisories

The release at a glance

In the week of 26 October to 1 November 2026, the maintainers of WordPress, GLPI, Nextcloud, Moodle, Frappe/ERPNext, Dolibarr and Drupal published 39 vulnerability advisories, 16 of them with a CVE id and 23 as GitHub security advisories. Severity breaks down as one critical, 17 high, 7 medium and 14 unscored. None is listed in CISA KEV, and none is flagged as exploited in the public advisories.

WordPress accounts for 12 of the advisories, GLPI for 10, Nextcloud and Moodle for 4 each, and Frappe/ERPNext, Dolibarr and Drupal for 3 each. The most immediate items are the critical Frappe path-traversal RCE, an unauthenticated SQL injection in GLPI, and a WordPress Core staged-installer RCE for which no fixed version is stated. Dolibarr also fixes an OS command injection.

What matters most

Frappe/ERPNext — CVE-2026-119145 is a critical path traversal in file upload (CVSS 4.0 9.4). An authenticated attacker can write files outside the intended storage directory and achieve remote code execution. CVE-2026-119144 is server-side template injection in message fields (8.7); an authenticated user with a common operational role can inject template expressions evaluated in an unrestricted context. Both CVEs have their own pages on this site.

GLPI — GHSA-753w-2942-4pxm is an unauthenticated, time-based SQL injection in the planning feature (8.7), fixed in 11.0.9. GHSA-hv93-qr6v-7mpj is a race condition that can allow installation of a malicious plugin archive (8.9), fixed in 10.0.27 or 11.0.9. Other high-severity GLPI advisories cover stored XSS in ticket actors, asset names and network equipment models, MFA bypass via password reset, arbitrary file deletion and malicious upload; most are fixed in 11.0.9, with some also fixed in 10.0.27.

Dolibarr — CVE-2026-116219 is OS command injection via the mysqldump parameter in htdocs/admin/tools/export.php (8.6). An authenticated administrator can chain commands with & around an allowlisted basename to execute commands as the web server user; fixed in 24.0.0. This CVE has its own page on this site.

WordPress — CVE-2026-119977 is an unauthenticated staged-installer remote code execution during the full-package core upgrade window (8.1). Its published title lists affected versions 4.7.0 through 7.1.3, and no fixed version is given. This CVE has its own page on this site.

Patch in this order

1. Patch Frappe first. CVE-2026-119145 is critical and fixed in Frappe 15.121.0 and 16.34.0; CVE-2026-119144 is fixed in Frappe 15.111.0 and 16.21.0. Apply the appropriate update for your installation.
2. Patch GLPI. GLPI 11.0.9 fixes the unauthenticated SQL injection, MFA bypass and stored XSS advisories in this release. GLPI 10.0.27 is listed for the race condition, arbitrary file deletion and malicious upload advisories; apply the update that matches your installation.
3. Patch Dolibarr to 24.0.0 to address CVE-2026-116219.
4. Treat WordPress Core CVE-2026-119977 separately: no patch is available and no workaround is stated. Monitor WordPress release channels for a fix.
5. Then apply the remaining medium and unscored updates for Moodle, Drupal, Nextcloud and the other WordPress advisories as the maintainers publish fixes.

Beyond the patch

Most of this week's serious flaws are injection and arbitrary code execution issues, which a penetration test and hardening review surface before they become operational risk. Our Implementation & Assessment Services test for injection, deserialisation and authentication weaknesses like these. Because successful exploitation of the critical Frappe, GLPI or Dolibarr issues would leave post-exploitation activity, Managed Detection & Response is the safety net for code execution and credential abuse until patches are applied.