Executive brief
GLPI is an open-source IT asset management and service desk platform used to track hardware, software, and support tickets. A vulnerability allows a user with technician-level privileges to delete any file on the server that the web application has permission to modify. This could lead to a complete loss of application data, system instability, or a total service outage if critical configuration or database files are removed.
Technical details
A missing authorization vulnerability (CWE-862) in GLPI allows authenticated users with 'technician' privileges to perform arbitrary file deletion. The flaw exists because the application fails to properly validate or restrict file paths during certain deletion operations, allowing an attacker to target files outside of the intended scope. Exploitation requires network access and high-level (technician) privileges but no user interaction. An attacker can delete any file on the filesystem that the web server process has write permissions for, potentially leading to a denial-of-service or destruction of application data. The issue is resolved in versions 10.0.25 and 11.0.7.
Affected products
- glpi-project GLPI >= 0.78, < 10.0.25; >= 11.0.0, < 11.0.7
Timeline
- 2026-06-01: advisory: GitHub Security Advisory published by vendor
- 2026-06-03: disclosed: CVE published in NVD