# CVE-2026-47679: GLPI path traversal in profile picture upload

Source: https://junglewise.ai/threats/cve-2026-47679-glpi-is-a-free-asset-and-it-management-software-package-from-10-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-47679 · Severity: info · Published 2026-09-25

GLPI is a free asset and IT management software used by organizations to track and manage IT infrastructure and resources. A logged-in user can exploit insufficient path validation in the profile picture update feature to delete arbitrary files on the server, potentially causing data loss or disrupting service availability. This requires an attacker to already have valid user credentials.

Technologies: [GLPI Project GLPI](https://junglewise.ai/threats/technologies/glpi-project-glpi). Vendors: [GLPI Project](https://junglewise.ai/threats/vendors/glpi-project).

## Quick answers

**Is CVE-2026-47679 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47679 being exploited in the wild.

**How severe is CVE-2026-47679?** Informational severity, published 25 September 2026.

**Which products and versions are affected?** GLPI Project GLPI 10.0.0 to 10.0.25, 11.0.0 to 11.0.7.

**Is there a fix for CVE-2026-47679?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-47679 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-47679?** Check whether you run GLPI Project GLPI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the profile picture update functionality (User.php prepareInputForUpdate method) where user-supplied paths are not properly validated before file operations. An authenticated attacker can supply a crafted path that bypasses directory restrictions and cause deletion of server files via the unlink operation. The vulnerability affects versions 10.0.0–10.0.25 and 11.0.0–11.0.7, with fixes applied in 10.0.26 and 11.0.8.

## Affected products

- GLPI Project GLPI 10.0.0 to 10.0.25, 11.0.0 to 11.0.7

## Timeline

- 2026-09-25: disclosed

## References

- [https://github.com/glpi-project/glpi/commit/54306faf6a724321ba82c53c7c07ff6612a0d832](https://github.com/glpi-project/glpi/commit/54306faf6a724321ba82c53c7c07ff6612a0d832)
- [https://github.com/glpi-project/glpi/commit/78ec583051bac3c1b3f9d21729c55cac62afa2f3](https://github.com/glpi-project/glpi/commit/78ec583051bac3c1b3f9d21729c55cac62afa2f3)

## Related threats

- [GLPI authorization bypass in document access](https://junglewise.ai/threats/cve-2026-57152-glpi-is-a-free-asset-and-it-management-software-package-from-0-85)
- [GLPI authorization bypass in knowledge base visibility](https://junglewise.ai/threats/cve-2026-53631-glpi-is-a-free-asset-and-it-management-software-package-from-0-83)
- [GLPI 2FA bypass in login via crafted URL](https://junglewise.ai/threats/cve-2026-52848-glpi-is-a-free-asset-and-it-management-software-package-from-11-0)
- [GLPI SQL injection in dropdown values endpoint](https://junglewise.ai/threats/cve-2026-47678-glpi-is-a-free-asset-and-it-management-software-package-from-9-4)
- [GLPI privilege escalation in account cloning](https://junglewise.ai/threats/cve-2026-121559-glpi-10-0-0-before-10-0-28-and-11-0-0-before-11-0-10-contains-a)