CVE-2026-47679
GLPI is a free asset and IT management software package
- Risk score
- 56/100
- CVSS
- 8.5 v4.0
- Exploit chance (30 days)
- 0.3%
- Published
- 25 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions 11.0.8 and 10.0.26.
- Affected
- See advisory
- Fix
- Upgrade the product to 11.0.8 or 10.0.26 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.5 high
References
- https://github.com/glpi-project/glpi/commit/54306faf6a724321ba82c53c7c07ff6612a0d832
- https://github.com/glpi-project/glpi/commit/78ec583051bac3c1b3f9d21729c55cac62afa2f3
- https://github.com/glpi-project/glpi/releases/tag/10.0.26
- https://github.com/glpi-project/glpi/releases/tag/11.0.8
- https://github.com/glpi-project/glpi/security/advisories/GHSA-x5r8-r6vj-79cw
Original description
GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions 11.0.8 and 10.0.26.
Last activity 25 Sep 2026. Patch Forecast updates every hour.