Insufficient Path Validation in GLPI IT Management Software
CVE-2026-47679
8.5HIGH
What is CVE-2026-47679?
GLPI is a widely used free asset and IT management software package, which contains a vulnerability where authenticated users may exploit insufficient path validation during the profile-picture update process. This flaw allows an attacker to issue a request for deletion of arbitrary files hosted on the server, potentially leading to significant security risks. Users of GLPI versions 10.0.0 through 10.0.26 and 11.0.8 are strongly advised to upgrade to the latest versions to mitigate this issue.
Affected Version(s)
glpi >= 10.0.0, < 10.0.26 < 10.0.0, 10.0.26
glpi >= 11.0.0, < 11.0.8 < 11.0.0, 11.0.8