CVE-2026-22248: GLPI RCE Vulnerability

CVE-2026-22248 Overview

CVE-2026-22248 is a high-severity insecure deserialization vulnerability affecting GLPI, an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking, and software auditing. This vulnerability exists in GLPI versions from 11.0.0 to before 11.0.5, where an authenticated technician user can upload a malicious file and trigger its execution through an unsafe PHP instantiation mechanism.

Critical Impact

Authenticated attackers with technician-level privileges can achieve remote code execution on vulnerable GLPI instances by uploading and executing malicious PHP files, potentially leading to complete system compromise.

Affected Products

• GLPI versions 11.0.0 through 11.0.4
• GLPI installations with authenticated technician-level user accounts
• Systems running PHP with unsafe object instantiation configurations

Discovery Timeline

• 2026-03-11 - CVE CVE-2026-22248 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-22248

Vulnerability Analysis

This vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and allows authenticated technician users to upload malicious files that can subsequently be executed through an unsafe PHP instantiation process. The attack requires network access and elevated privileges (technician account), but can result in a complete compromise of confidentiality, integrity, and availability with scope change implications affecting resources beyond the vulnerable component.

The vulnerability's network-based attack vector combined with the requirement for authenticated access and high attack complexity indicates that while exploitation requires specific conditions to be met, successful attacks can have devastating consequences for affected organizations.

Root Cause

The root cause of CVE-2026-22248 lies in improper handling of file uploads combined with unsafe PHP object instantiation. GLPI fails to properly validate and sanitize uploaded files before allowing them to be processed by PHP, enabling attackers to upload malicious payloads that exploit the unsafe instantiation mechanism. The application does not adequately restrict what types of objects can be instantiated, allowing attackers to leverage this weakness for arbitrary code execution.

Attack Vector

The attack vector for this vulnerability involves the following sequence:

1. An attacker authenticates to the GLPI application with technician-level privileges
2. The attacker crafts a malicious file containing PHP code or serialized object payloads
3. The malicious file is uploaded through a vulnerable file upload functionality
4. The attacker triggers the unsafe PHP instantiation mechanism, causing the malicious code to execute
5. Upon successful exploitation, the attacker gains code execution capabilities on the underlying server

The vulnerability exploits the trust relationship between the file upload mechanism and the PHP instantiation process. When the uploaded file is processed, the unsafe instantiation allows the attacker-controlled content to be deserialized and executed, bypassing intended security controls. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-22248

Indicators of Compromise

• Unusual file uploads to GLPI directories, particularly files with PHP extensions or serialized object content
• Unexpected process execution spawned by the GLPI web server process
• Web server logs showing suspicious POST requests to file upload endpoints from technician accounts
• Presence of unfamiliar files in upload directories or temporary storage locations

Detection Strategies

• Monitor file upload activities within GLPI for suspicious file types or content patterns
• Implement web application firewall (WAF) rules to detect serialized PHP object patterns in upload requests
• Enable detailed logging on GLPI application servers and review for anomalous instantiation activities
• Deploy endpoint detection and response (EDR) solutions to monitor for unauthorized code execution from web server processes

Monitoring Recommendations

• Configure SIEM alerts for unusual file upload patterns from technician accounts
• Monitor PHP process execution chains for signs of malicious activity originating from uploaded content
• Implement file integrity monitoring on GLPI installation directories
• Review authentication logs for suspicious technician account activity or privilege abuse

How to Mitigate CVE-2026-22248

Immediate Actions Required

• Upgrade GLPI to version 11.0.5 or later immediately
• Review and audit technician-level user accounts for unauthorized access or suspicious activity
• Temporarily restrict file upload capabilities until patching is complete
• Implement network segmentation to limit the impact of potential compromise

Patch Information

The GLPI development team has addressed this vulnerability in version 11.0.5. Organizations running affected versions (11.0.0 through 11.0.4) should upgrade immediately. The security patch addresses the unsafe PHP instantiation mechanism by implementing proper input validation and object instantiation controls.

For detailed patch information and upgrade instructions, refer to the GitHub Security Advisory.

Workarounds

• Implement strict file upload restrictions at the web server level to block potentially malicious file types
• Apply network-level access controls to limit GLPI access to trusted networks only
• Disable or restrict technician account capabilities where possible until patching is complete
• Deploy web application firewalls with rules to detect and block serialized PHP object payloads

# Example: Restrict file upload types in Apache .htaccess
# Add to GLPI installation directory
<FilesMatch "\.(php|phtml|php3|php4|php5|phps)$">
    Require all denied
</FilesMatch>

# Example: Nginx configuration to restrict PHP execution in upload directories
location ~* /files/.*\.php$ {
    deny all;
}