File Deletion Vulnerability in GLPI IT Management Software
CVE-2026-42317

7HIGH

Key Information:

Vendor

GLPI Project
Status
Glpi
Vendor
CVE Published:
3 June 2026

What is CVE-2026-42317?

A security vulnerability in GLPI allows technicians to delete arbitrary files from the filesystem due to inadequate permissions management. If the webserver has write rights on certain files, an attacker could exploit this flaw, leading to potential data loss or system instability. Users are advised to upgrade to GLPI versions 10.0.25 or 11.0.7, where the issue is patched.

Affected Version(s)

glpi >= 11.0.0, < 11.0.7 < 11.0.0, 11.0.7

glpi >= 0.78, < 10.0.25 < 0.78, 10.0.25

References

https://github.com/glpi-project/glpi/security/advisories/...
x_refsource_CONFIRM

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.