GLPI 11.0.8 fixes remote code execution via Form import and nine further vulnerabilities

What happened

GLPI 11.0.8 closes ten security issues. The most severe is CVE-2026-48482, a critical remote code execution flaw in Form import: a user with form administrator rights can import a crafted illustration or scene identifier that escapes the intended custom-asset directory, writes a file to an executable server location, and allows a malicious script to be invoked remotely. It is rated CVSS 4.0 9.4.

The remaining nine issues span file handling, injection, cross-site scripting and authorisation. CVE-2026-47679 lets any logged-in user request deletion of an attacker-selected server file through the profile-picture update flow. CVE-2026-53629 is SQL injection in the history tab, reachable by a user with READ right on logs. CVE-2026-49470 permits brute-forcing of the TOTP second factor once primary credentials are known. The update also addresses stored and reflected cross-site scripting, authtype and entity-scope authorisation bypasses, unallowed API update operations, and arbitrary document read.

The CVE records do not list these issues in CISA KEV, and do not report public disclosure or active exploitation.

Who is affected

GLPI is a self-hosted IT asset and service management package, typically used for helpdesk, asset inventory and change management. The affected product is self-hosted GLPI.

The critical form import flaw, the TOTP brute-force issue, the reflected XSS, the API update issue and several other defects affect GLPI from 11.0.0 until 11.0.8. The stored XSS issue affects GLPI from 11.0.6 until 11.0.8; the arbitrary document read issue affects GLPI from 11.0.5 until 11.0.8.

Four issues also affect the 10.0 line or older branches: arbitrary file deletion from 10.0.0 until 10.0.26, authtype privilege escalation from 0.70 until 10.0.26, SQL injection from 9.4.0 until 10.0.26, and the unallowed authentication method update from 0.84 until 10.0.26. The fixed release for the 10.0 line is 10.0.26.

What to do now

1. Confirm your installed GLPI version. If you run GLPI 11.0 before 11.0.8, upgrade to 11.0.8. If you run GLPI 10.0 before 10.0.26, upgrade to 10.0.26.
2. Prioritise any internet-facing GLPI web interface or API, because the most severe issues are reachable over the network.
3. The GLPI advisory does not list workarounds. If you cannot upgrade immediately, restrict access to the GLPI web interface and API to trusted management networks. Keep MFA enabled where possible, but be aware that CVE-2026-49470 weakens TOTP protection for accounts whose primary credentials are already compromised.
4. After upgrading, review highly privileged accounts, authentication methods and API permissions for changes you did not authorise.

Beyond the patch

GLPI is often treated as internal plumbing, but this update shows why it needs the same patch discipline and control testing as any externally supplied platform. Our Implementation & Assessment Services can penetration-test and harden GLPI before the next update, and Supply Chain Defense & Third-Party Risk helps you track which versions of GLPI and other software you run and how quickly you close their exposure windows.