Untriaged
Permalink
CVE-2026-22248
8.1 HIGH
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): HIGH
- Privileges required (PR): HIGH
- User interaction (UI): NONE
- Scope (S): CHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): HIGH
- Availability impact (A): HIGH
GLPI affected by Remote Code Execution via malicious upload
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. From 11.0.0 to before 11.0.5, an authenticated technician user can upload a malicious file and trigger its execution through an unsafe PHP instantiation. This vulnerability is fixed in 11.0.5.
References
- https://github.com/glpi-project/glpi/security/advisories/GHSA-c9q3-mcxq-9vr4 x_refsource_CONFIRM
Affected products
glpi
- ==>= 11.0.0, < 11.0.5
Package maintainers
-
@liberodark liberodark <liberodark@gmail.com>