CVE-2015-7684

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 0.85.3

Description The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as an attachment to a new ticket and then accessing it directly. This is achieved by adding the file to files/ tmp/ and then making a direct request to the file.

Recommendations For versions prior to 0.85.3, update to version 0.85.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the files/ tmp/ directory to prevent direct requests to uploaded files. Additionally, restrict the types of files that can be uploaded as attachments to prevent executable files from being added.