CVE-2026-42317: GLPI Path Traversal Vulnerability

CVE-2026-42317 Overview

CVE-2026-42317 is a missing authorization vulnerability [CWE-862] in GLPI, an open-source asset and IT management software package. The flaw allows a low-privileged technician account to delete arbitrary files from the underlying filesystem, provided the webserver process has write permissions on the target files. The issue affects GLPI versions starting from 0.78 and is fixed in versions 10.0.25 and 11.0.7.

Critical Impact
Authenticated technicians can delete arbitrary server files, leading to integrity and availability loss across GLPI deployments and any co-located files writable by the webserver.

Affected Products

GLPI versions 0.78 through 10.0.24
GLPI versions 11.0.0 through 11.0.6
Self-hosted GLPI instances where the webserver user owns application or system files

Discovery Timeline

2026-06-03 - CVE-2026-42317 published to the National Vulnerability Database (NVD)
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-42317

Vulnerability Analysis

The vulnerability resides in a GLPI function that handles file deletion operations. The application fails to verify that the requesting user holds the correct authorization to delete the targeted file. A technician, which is a standard non-administrative role in GLPI, can invoke the deletion path and remove files unrelated to the resources they are authorized to manage.

Because the deletion is executed by the webserver process, the impact is bounded by the filesystem permissions of that process. In typical Linux deployments where the webserver owns the GLPI application directory, an attacker can remove configuration files, plugin code, attachments, log files, or cached data. Removing such files can disable the application or corrupt audit trails.

Root Cause

The root cause is a missing authorization check [CWE-862] on a file deletion operation exposed to authenticated technician sessions. The endpoint accepts a file reference parameter and acts on it without confirming that the caller has rights over the specific resource.

Attack Vector

Exploitation requires network access to the GLPI web interface and valid technician credentials. The attacker authenticates, then issues a crafted request to the vulnerable deletion endpoint referencing an arbitrary filesystem path. No user interaction is required. See the GitHub Security Advisory GHSA-jf72-cvjh-px5w for technical details.

// No verified public exploit code is available for CVE-2026-42317.
// Refer to the upstream advisory for technical specifics.

Detection Methods for CVE-2026-42317

Indicators of Compromise

Unexpected deletion of files within the GLPI files/, config/, or plugins/ directories owned by the webserver user
Web access logs showing technician-role sessions invoking document or attachment deletion endpoints with unusual parameter values
Application errors or sudden plugin failures correlated with technician account activity

Detection Strategies

Enable verbose GLPI application logging and audit any deletion actions performed by non-administrative roles
Compare filesystem inventories against known-good baselines to detect removals of configuration or code files
Correlate webserver access logs with GLPI authentication logs to identify technician sessions issuing file-management requests outside expected workflows

Monitoring Recommendations

Alert on unlink, rm, or equivalent syscalls executed by the webserver process against paths outside the GLPI upload directories
Monitor for elevated request volume from technician accounts targeting GLPI endpoints handling documents or attachments
Track integrity changes on critical GLPI files such as config/config_db.php and installed plugin source files

How to Mitigate CVE-2026-42317

Immediate Actions Required

Upgrade GLPI to version 10.0.25 or 11.0.7 without delay
Audit the technician role membership and remove unnecessary accounts pending the upgrade
Back up the GLPI application directory, attachments, and database before applying the patch

Patch Information

The GLPI maintainers released fixes in versions 10.0.25 and 11.0.7. The patch adds the missing authorization check on the affected file deletion path. Administrators should download the upgrade from the official GLPI release channel and follow the documented upgrade procedure. Full details are available in the GitHub Security Advisory GHSA-jf72-cvjh-px5w.

Workarounds

Restrict webserver filesystem write permissions to the minimum required directories, limiting the blast radius of arbitrary deletion
Temporarily suspend technician accounts that are not strictly required for operations until the upgrade is applied
Place the GLPI instance behind a web application firewall and block requests to file deletion endpoints from non-administrative sessions

bash

# Example: tighten filesystem permissions so only upload directories are writable
chown -R root:www-data /var/www/glpi
find /var/www/glpi -type d -exec chmod 750 {} \;
find /var/www/glpi -type f -exec chmod 640 {} \;
chown -R www-data:www-data /var/www/glpi/files
chmod -R 770 /var/www/glpi/files