Critical remote code execution vulnerability affecting GLPI
A critical vulnerability affecting GLPI would allow a malicious actor with administrator privileges to remotely execute arbitrary code on affected systems.
Description
Technical context and vulnerability details
GLPI is an open-source IT asset management solution that allows you to identify, organize and supervise IT equipment, software and support requests. This solution is affected by a vulnerability labeled CVE-2026-26026 resulting from server-side model injection (SSTI) related to double compilation. Exploitation of this vulnerability would allow an attacker with administrator privileges to remotely execute arbitrary code on target systems. It is classified critical with a severity score of 9.1 according to CVSS v3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Compromise of system integrity;
- Data privacy breach;
- System availability compromised;
Affected systems
Products, components and targeted versions
- GLPI versions prior to 11.0.5;
- GLPI versions prior to 10.0.24;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update GLPI to version 11.0.6 or 10.0.24, depending on the branch used, or to a later version;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.