CVE-2026-75105 phpipam CVE debrief

Who should care

System administrators and security teams using phpIPAM, especially those with publicly accessible temporary share URLs, should assess exposure and apply remediation. They should verify whether affected product deployments exist in managed environments, review official advisories, and plan vendor-supported updates or mitigations. Security teams should also review compensating controls, monitor for suspicious activity, and track exceptions.

Why it matters

CVE-2026-75105 is a high-severity information disclosure vulnerability in phpIPAM's temporary subnet share functionality. System administrators and security teams should assess exposure, especially for publicly accessible instances, and apply remediation by upgrading to version 1.8.2 or later. The vulnerability allows unauthenticated access to sensitive information, including IP address records and configuration details. Evidence is based on CVE description and source references; vendor remediation is available.

• Read access to sensitive IP address records and configuration details.
• Potential enumeration of subnet IDs to gather information across all sections and subnets.
• Exposure of hostnames, DNS names, MAC addresses, and notes, which may contain credentials and configuration details.
• Verification priority for phpIPAM instances to ensure they are not vulnerable.

Technical summary

phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. This allows an unauthenticated party holding any valid, non-expired temporary share URL to enumerate the subnetId parameter and read every IP address record across all sections and subnets, including hostnames, DNS names, MAC addresses, owner/contact fields, and notes. The vulnerability is due to insufficient validation of the subnetId parameter in app/temp_share/index.php and app/temp_share/address.php. Evidence is based on CVE description and source references; vendor remediation is available.

Defensive priority

High priority for systems using phpIPAM 1.8.1 or earlier, especially those with publicly accessible temporary share URLs.

Recommended defensive actions

• Verify exposure of phpIPAM instances, especially those with publicly accessible temporary share URLs.
• Assess inventory for phpIPAM version 1.8.1 or earlier.
• Apply vendor remediation by upgrading to phpIPAM version 1.8.2 or later.
• Restrict access to temporary share URLs and monitor for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE description and source references indicate that phpIPAM 1.8.1 and earlier versions are affected. The vulnerability allows unauthenticated access to IP address records and sensitive information. Vendor remediation is available in version 1.8.2.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.