CVE-2026-48482

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.7

Description A form administrator can utilize the Form import feature with a specially crafted illustration or scene identifier to perform a directory traversal attack, allowing files to be written outside the intended custom-asset directory. If the imported file is written to an executable server location, it can lead to remote code execution by invoking a malicious script.

Recommendations Update to version 11.0.8.