GLPI 11.0.8 fixes remote code execution via Form import (CVE-2026-48482) and other high-severity flaws

What happened

The most severe issue is CVE-2026-48482, a remote code execution flaw in GLPI 11.0.0 to before 11.0.8. A user with form administrator rights can import a form using a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can then be written to an executable server location, allowing a malicious script to be invoked remotely. GLPI rates this critical, with a CVSS 4.0 score of 9.4: network attack vector, low attack complexity, high privileges required and no user interaction.

GLPI's 11.0.8 release also fixes nine further issues. GHSA-hgr8-qvp5-mhch lets any user craft a URL that skips one-time password verification during login. CVE-2026-47679 allows any logged-in user to request deletion of an attacker-selected file through the profile-picture update flow. SQL injection exists in the dropdown values endpoint for any authenticated user, and in the history tab for users with READ rights on logs. The release also addresses stored cross-site scripting in supplier website fields, reflected cross-site scripting in dashboards, missing rate limiting on TOTP verification when primary credentials are known, authtype API privilege escalation that can change another user's authentication method and enable account takeover under legacy REST or SSO configurations, and a form context authorization bypass allowing unauthorised document reads.

None of these flaws is listed in CISA KEV, and the CVE records do not state exploitation in the wild.

Who is affected

GLPI is a free asset and IT management package, commonly run as an internal helpdesk and asset register. CVE-2026-48482, GHSA-hgr8-qvp5-mhch, CVE-2026-49470 and CVE-2026-53610 affect GLPI 11.0.0 to before 11.0.8. CVE-2026-55214 affects GLPI 11.0.6 to before 11.0.8, and CVE-2026-53626 affects GLPI 11.0.5 to before 11.0.8. CVE-2026-47679, GHSA-v774-5g3p-vxg2 and CVE-2026-53629 affect GLPI 10.0.0 to before 10.0.26 and 11.0.0 to before 11.0.8; the SQL injection flaws GHSA-v774-5g3p-vxg2 and CVE-2026-53629 also affect GLPI 9.4.0 to before 10.0.26. CVE-2026-53625 affects GLPI 0.70 to before 10.0.26 and 11.0.0 to before 11.0.8.

What to do now

1. Upgrade to a fixed release. GLPI 11.0.8 fixes the issues affecting GLPI 11.0.0 to before 11.0.8. GLPI 10.0.26 fixes issues affecting GLPI 9.4.0 to before 10.0.26 and 10.0.0 to before 10.0.26. If you run GLPI 0.70 to before 10.0.26, 10.0.26 is the fixed release for CVE-2026-53625. Confirm which CVEs apply to your release before choosing the target version.
2. No workaround has been published by GLPI for this bundle. If you cannot upgrade immediately, restrict network access to GLPI and review high-privilege accounts, including form administrators and users of the legacy API REST or SSO logins.
3. After patching, review authentication method changes and reset credentials where account takeover may have been possible, particularly where the legacy API REST interface or SSO logins are used.

How to detect it

The vendor has not published specific indicators of compromise for these flaws. Review application and web server logs for unusual form imports, profile-picture update requests, dropdown-fetching and history-tab requests with unexpected parameters, repeated failed TOTP submissions, and crafted dashboard or supplier-list URLs. Check the web root and custom-asset directories for unexpected executable files.

Beyond the patch

This bundle is a patch-cycle problem as much as a technical one: GLPI publishes a single 11.0.8 update that closes critical remote code execution and nine other high-severity flaws, while older affected release ranges are directed to 10.0.26. Implementation & Assessment Services includes penetration testing and hardening reviews that find injection and authentication flaws before they reach production. Supply Chain Defense & Third-Party Risk tracks supplier patch cycles such as GLPI's, so the gap between a vendor fix and your deployment is measured and driven down.