PT-2026-99065 · Glpi · Glpi
CVE-2026-47679
·
Published
2026-09-25
·
Updated
2026-09-25
CVSS v4.0
8.5
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H |
Name of the Vulnerable Software and Affected Versions
GLPI versions 10.0.0 through 10.0.25
GLPI versions prior to 11.0.8
Description
Insufficient path validation in the profile-picture update flow allows any logged-in user to request the deletion of an arbitrary file hosted on the server selected by the attacker.
Recommendations
Update to version 10.0.26.
Update to version 11.0.8.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Glpi