CVE-2026-47679

Deferred Deferred - Pending Action

Path Traversal in GLPI Profile Picture Update

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions 11.0.8 and 10.0.26.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-47679

Affected Vendors & Products

Vendor	Product	Version / Range
glpi	glpi	to 10.0.26 (inc)
glpi	glpi	11.0.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability in GLPI allows any logged-in user to exploit insufficient path validation when updating their profile picture. This lets them request deletion of an attacker-selected file hosted on the server.

Detection Guidance

This vulnerability allows any logged-in user to delete arbitrary files on the server due to insufficient path validation in the profile-picture update feature. To detect it, check for unauthorized file deletions in system logs, especially in directories where GLPI stores files. Look for suspicious activity in the profile-picture update endpoint or logs indicating file removal outside expected directories.

Impact Analysis

An attacker could delete critical files on the server, potentially causing data loss or service disruption. This could lead to unauthorized access to sensitive information or system instability.

Compliance Impact

This vulnerability could lead to unauthorized file deletion or data exposure, which may violate compliance requirements for data integrity and security under GDPR or HIPAA.

Mitigation Strategies

Upgrade GLPI to version 11.0.8 or 10.0.26 or later to address the insufficient path validation issue in the profile-picture update flow.

Hi! I’m here to help you understand CVE-2026-47679. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70