CVE-2026-47679 in GLPI
Summary
by MITRE • 09/25/2026
GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions 11.0.8 and 10.0.26.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
GLPI serves as a comprehensive open-source asset and IT management software package widely deployed for tracking hardware, software, and network infrastructure within enterprise environments. The vulnerability identified affects GLPI versions ranging from 10.0.0 through 10.0.25, as well as the specific release 11.0.8 prior to its patching in version 11.0.9 or later depending on the branch. This security flaw resides within the user profile management subsystem, specifically targeting the functionality responsible for updating a user's profile picture. The core technical deficiency is characterized by insufficient path validation during the file handling process. When an authenticated user initiates a request to update their avatar, the application fails to adequately sanitize or validate the target file path provided in the input parameters. This lack of rigorous checks allows an attacker to manipulate the underlying filesystem operations through directory traversal techniques. By injecting sequences such as dot-dot-slash into the filename parameter, the malicious actor can redirect the deletion operation away from the intended user-specific storage directories and onto arbitrary locations within the server's file system where GLPI has write permissions or access rights.
The operational impact of this vulnerability is significant because it enables an authenticated attacker to perform unauthorized file deletions on the host machine running the GLPI application. Unlike many web vulnerabilities that require unauthenticated access, this flaw leverages valid user credentials, which are often easier for threat actors to obtain through phishing, credential stuffing, or internal compromise. The ability to delete arbitrary files can lead to a denial of service condition if critical configuration files, database connection scripts, or core application binaries are targeted and removed. Furthermore, the deletion of log files could hinder forensic analysis and incident response efforts by obscuring evidence of prior malicious activity. In more severe scenarios, if an attacker targets specific system-level files that GLPI has access to via user permissions, it could potentially destabilize the operating environment or facilitate further exploitation vectors such as path traversal leading to remote code execution if combined with other vulnerabilities in the stack.
From a classification perspective, this vulnerability aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as directory traversal. The root cause is the application's failure to enforce strict boundaries on user-supplied input when interacting with the file system API. In terms of offensive security frameworks, this behavior maps to ATT&CK technique T1083: File and Directory Discovery or more accurately T1485: Data Destruction, as the primary outcome is the intentional deletion of data. The exploitation chain typically involves logging into the GLPI interface with a low-privilege user account, navigating to the profile settings, and submitting a crafted HTTP request that includes malicious path sequences in the file upload or update endpoint. Because the vulnerability relies on authenticated access, it represents an insider threat vector as well as an external attack surface if credentials are compromised.
Mitigation strategies must prioritize immediate patching of all affected GLPI instances to versions 10.0.26 and later for the legacy branch, or version 11.0.9 and later for the current release line where this issue has been resolved by implementing strict input validation and canonicalization checks on file paths before processing deletion requests. Administrators should also enforce the principle of least privilege by ensuring that the user account under which the GLPI web application runs does not possess write or delete permissions over critical system directories, configuration files outside the designated upload folders, or sensitive operational data. Regular audits of file permission structures and monitoring for unusual patterns in server logs related to file operations can provide early detection indicators. Additionally, implementing Web Application Firewall rules that detect common directory traversal sequences may offer a layer of defense-in-depth while patching is being applied across the infrastructure.