CVE-2022-24780

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.

• CWE-94

• http://packetstormsecurity.com/files/167236/iTop-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3Patch, Third Party Advisory
• https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06bPatch, Third Party Advisory
• https://github.com/Combodo/iTop/commit/eb2a615bd28100442c7f6171707bb40884af2305Patch, Third Party Advisory
• https://github.com/Combodo/iTop/security/advisories/GHSA-v97m-wgxq-rh54Third Party Advisory
• https://markus-krell.de/itop-template-injection-inside-customer-portal/Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/167236/iTop-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3Patch, Third Party Advisory
• https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06bPatch, Third Party Advisory
• https://github.com/Combodo/iTop/commit/eb2a615bd28100442c7f6171707bb40884af2305Patch, Third Party Advisory
• https://github.com/Combodo/iTop/security/advisories/GHSA-v97m-wgxq-rh54Third Party Advisory
• https://markus-krell.de/itop-template-injection-inside-customer-portal/Exploit, Third Party Advisory

Published

Apr 5, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24774CycloneDX BOM Repository Server is a bill of materials (BOM)…8.1
• CVE-2022-24775guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions pr…7.5
• CVE-2022-24776Flask-AppBuilder is an application development framework, bu…6.1
• CVE-2022-24777grpc-swift is the Swift language implementation of gRPC, a r…7.5
• CVE-2022-24778The imgcrypt library provides API exensions for containerd t…7.5
• CVE-2022-2478Use after free in PDF in Google Chrome prior to 103.0.5060.1…8.8
• CVE-2022-24781Geon is a board game based on solving questions about the Py…7.1
• CVE-2022-24782Discourse is an open source discussion platform. Versions 2.…4.3
• CVE-2022-24783Deno is a runtime for JavaScript and TypeScript. The version…10
• CVE-2022-24784Statamic is a Laravel and Git powered CMS. Before versions 3…3.7
• CVE-2022-24785Moment.js is a JavaScript date library for parsing, validati…7.5
• CVE-2022-24786PJSIP is a free and open source multimedia communication lib…9.8