File Upload Vulnerability in GLPI IT Management Software
CVE-2026-22248

8.1HIGH

Key Information:

Vendor

GLPI Project
Status
Glpi
Vendor
CVE Published:
11 March 2026

What is CVE-2026-22248?

GLPI, an open-source asset and IT management software, is prone to a file upload vulnerability. Users with technician-level authentication can upload malicious files that get executed through an unsafe PHP instantiation. This security flaw is present in versions 11.0.0 to prior to 11.0.5, making it crucial for users to upgrade to the latest version to mitigate risks. For more information, refer to the security advisory.

Affected Version(s)

glpi >= 11.0.0, < 11.0.5

References

https://github.com/glpi-project/glpi/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.