File Upload vulnerability affecting GLPI
A critical vulnerability affecting GLPI would allow a malicious actor to upload arbitrary files to affected systems.
Description
Technical context and vulnerability details
GLPI is an open source IT asset management, incident tracking and technical support system. This solution is affected by a vulnerability labeled CVE-2026-22248 which results from insecure PHP instantiation. Exploitation of this vulnerability would allow an authenticated attacker to upload arbitrary files to target systems. It is classified high with a severity score of 8.0 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Compromise of system integrity;
- Breach of confidentiality and availability of data;
Affected systems
Products, components and targeted versions
- GLPI versions ranging from version 11.0.0 to 11.0.4;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update GLPI to the latest stable version;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.