CVE-2026-48482

Deferred Deferred - Pending Action

Path Traversal in GLPI Leading to Remote Code Execution

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location, allowing a malicious script to be invoked remotely. This issue is fixed in version 11.0.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-48482

Affected Vendors & Products

Vendor	Product	Version / Range
glpi	glpi	to 11.0.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability in GLPI versions 11.0.0 to 11.0.8 allows a form administrator to import a crafted file with a malicious identifier that escapes the intended custom-asset directory. The file can be written to an executable server location, enabling remote execution of a malicious script.

Detection Guidance

This vulnerability involves a form administrator exploiting GLPI's form import feature to write files outside the intended directory. Detection requires checking for unauthorized file writes in server directories, particularly those containing executable scripts. Review GLPI logs for suspicious import activities and verify file paths used during form imports. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to execute arbitrary code on the server, potentially leading to data breaches, unauthorized access, or system compromise. This could affect the confidentiality, integrity, and availability of the GLPI instance and its data.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements or HIPAA's security rules. Organizations using affected GLPI versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade GLPI to version 11.0.8 or later to address the vulnerability. Review imported forms and custom-asset directories for unauthorized files. Monitor server locations for unexpected executable scripts.

Hi! I’m here to help you understand CVE-2026-48482. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70