CVE-2026-48482— GLPI: RCE via Form import
Quick assessment
Affected
glpi-project glpi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GLPI 是一款免费的资产和 IT 管理软件包。在 11.0.0 到 11.0.8 版本中，表单管理员可以通过导入具有精心构造的插图或场景标识符的表单，使文件路径遍历到预期的自定义资产目录之外。导入的文件可以被写入服务器上的可执行位置，从而导致恶意脚本能够被远程调用。此问题已在 11.0.8 版本中修复。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-48482
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GLPI: RCE via Form import
Source: CVE Program / CVE List V5
Vulnerability Description
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location, allowing a malicious script to be invoked remotely. This issue is fixed in version 11.0.8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| glpi-project | glpi | >= 11.0.0, < 11.0.8 | - |
|
II. Public POCs for CVE-2026-48482
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-48482
请登录查看更多情报信息。
Other References for CVE-2026-48482 (3)
-
https://github.com/glpi-project/glpi/releases/tag/11.0.8 x_refsource_MISC
-
https://github.com/glpi-project/glpi/security/advisories/GHSA-6whc-g4h2-98rm x_refsource_CONFIRM
Same Patch Batch · glpi-project · 2026-09-25 · 13 CVEs total
| CVE-2026-47679 | 8.5 HIGH | GLPI: arbitrary file deletion |
| CVE-2026-55214 | 8.5 HIGH | GLPI: Stored XSS in suppliers |
| CVE-2026-49470 | 7.7 HIGH | GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Fo |
| CVE-2026-53625 | 7.5 HIGH | GLPI: Privilege Escalation via authtype API manipulation |
| CVE-2026-53610 | 7.5 HIGH | GLPI: Reflected XSS in dashboards |
| CVE-2026-53629 | 7.1 HIGH | GLPI: SQL injection in history tab |
| CVE-2026-53626 | 7.1 HIGH | GLPI: Arbitrary Document Read via Form Context Authorization Bypass |
| CVE-2026-53627 | 6.0 MEDIUM | GLPI: Unexpected access to update operations through the API |
| CVE-2026-53628 | 5.9 MEDIUM | GLPI: Unallowed authentication method update by administrator |
| CVE-2026-45801 | 5.3 MEDIUM | GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation) |
| CVE-2026-55217 | 5.3 MEDIUM | GLPI: Unallowed modfication of knowbase items comments and translations |
| CVE-2026-49469 | 4.6 MEDIUM | GLPI: LDAP filter injection in user import feature |
IV. Related Vulnerabilities
Same product: glpi
Same vendor: glpi-project
Same weakness: CWE-22
-
CVE-2026-90925
Path Traversal in Innotim Software's Logsign SIEM -
CVE-2026-85185
Path traversal in LXD btrfs storage driver allows arbitrary -
CVE-2026-85526
Path traversal via Btrfs optimized-backup subvolumes[].path -
CVE-2026-86334
CLI Path Traversal via Content-Disposition in LXD Image Expo -
CVE-2026-15953
Path Traversal During Project Archive Import
V. Comments for CVE-2026-48482
No comments yet