GBIF vulnerabilities
We track 3 vulnerabilities in GBIF products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 18, 2026.
Latest GBIF vulnerabilities
- 7.6 High severity
Integrated Publishing Toolkit: Improper Neutralization of Special Elements Used in a Template Engine
Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection
- 9.1 Critical severity
Integrated Publishing Toolkit: Authentication Bypass Using an Alternate Path or Channel
Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass
- 9.2 Critical severity
Integrated Publishing Toolkit: Missing Authentication for Critical Functionality
Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass