# CVE-2026-42320: GLPI arbitrary file read in GLPI_DOC_DIR

Source: https://junglewise.ai/threats/cve-2026-42320-glpi-arbitrary-file-read-in-glpi-doc-dir  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-03. Updated: 2026-06-03  
License: CC BY 4.0 with a link back

CVE-2026-42320 · Severity: info · CVSS 5.9 · Published 2026-06-03

GLPI is an open-source IT asset management and service desk platform used by organizations to track hardware, software, and support tickets. A security vulnerability allows users with technician-level privileges to access and read sensitive files stored within the application's document directory that they should not be able to see. This could lead to the exposure of internal documentation, configuration details, or other sensitive business data managed within the system.

Technologies: [Teclib GLPI](https://junglewise.ai/threats/technologies/glpi). Vendors: [Teclib](https://junglewise.ai/threats/vendors/teclib).

## Quick answers

**Is CVE-2026-42320 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42320 being exploited in the wild.

**How severe is CVE-2026-42320?** Informational severity, with a CVSS score of 5.9, published 3 June 2026.

**Which products and versions are affected?** Teclib GLPI >= 0.50, < 10.0.25; >= 11.0.0, < 11.0.7.

**Is there a fix for CVE-2026-42320?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42320 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42320?** Check whether you run Teclib GLPI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability (CWE-862) in GLPI allows an authenticated user with 'technician' privileges to access arbitrary files within the GLPI_DOC_DIR directory. The vulnerability stems from insufficient access control checks when retrieving documents. An attacker must have high-level (technician) privileges and navigate high attack complexity to successfully exploit this flaw. Successful exploitation results in a high confidentiality impact as the attacker can read sensitive files stored on the server, though it does not allow for file modification or service disruption. The issue is resolved in versions 10.0.25 and 11.0.7.

## Affected products

- Teclib' GLPI >= 0.50, < 10.0.25; >= 11.0.0, < 11.0.7

## Timeline

- 2026-05-18: advisory: Vendor advisory published on GitHub
- 2026-06-03: disclosed: CVE published in NVD

## References

- [https://github.com/glpi-project/glpi/security/advisories/GHSA-58j6-94cf-gcx5](https://github.com/glpi-project/glpi/security/advisories/GHSA-58j6-94cf-gcx5)

## Related threats

- [Teclib GLPI missing authorization in asset object access](https://junglewise.ai/threats/cve-2026-44281-teclib-glpi-missing-authorization-in-asset-object-access)
- [Teclib GLPI Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2022-35914-teclib-glpi-remote-code-execution-vulnerability)