CVE-2026-47679: GLPI Path Traversal Vulnerability

CVE-2026-47679 Overview

GLPI is a free, open-source asset and IT management software package used by organizations to track inventory, tickets, and infrastructure. CVE-2026-47679 is a path traversal vulnerability [CWE-22] in the profile-picture update flow. Any authenticated GLPI user can abuse insufficient path validation to request deletion of attacker-selected files hosted on the server. The flaw affects GLPI versions from 10.0.0 through 10.0.25 and all 11.x releases prior to 11.0.8. The project fixed the issue in GLPI 10.0.26 and 11.0.8.

Critical Impact
An authenticated low-privileged user can delete arbitrary files on the GLPI server, enabling integrity and availability loss across the application and potentially the underlying host.

Affected Products

GLPI 10.0.0 through 10.0.25
GLPI 11.x releases prior to 11.0.8
Fixed in GLPI 10.0.26 and 11.0.8

Discovery Timeline

2026-09-25 - CVE CVE-2026-47679 published to NVD
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-47679

Vulnerability Analysis

The vulnerability resides in GLPI's user profile picture update handler in src/User.php. When a user updates their profile picture, the application accepts a _picture input that references a file path on the server. The handler compares the resolved full path against the GLPI temporary directory to confirm the file lives inside the expected upload area. The pre-patch code triggered a warning when the path fell outside GLPI_TMP_DIR but continued processing. Execution then reached file-deletion logic that acted on the attacker-controlled path. A logged-in user could therefore target files anywhere accessible to the GLPI process user.

Root Cause

The root cause is incomplete path validation. The check used str_starts_with($fullpath, realpath(GLPI_TMP_DIR)) to confirm the file resided in the temporary directory. When the check failed, the code only emitted a trigger_error warning rather than aborting the operation. Downstream deletion routines then operated on paths outside the trusted directory, producing an arbitrary file deletion primitive.

Attack Vector

Exploitation requires an authenticated GLPI account with permission to update profile information. The attacker submits a profile-picture update request supplying a _picture value that resolves outside GLPI_TMP_DIR. Because the handler proceeded past the failed boundary check, GLPI issued an unlink against the attacker-chosen path. Suitable targets include configuration files, cached session data, log files, or application assets, which can disrupt availability or facilitate follow-on compromise.

php

// Pre-patch logic in src/User.php - the warning fired but execution continued.
// The fix (commits 54306fa and 78ec583) adds an explicit return to abort processing.
                }
                if (!str_starts_with($fullpath, realpath(GLPI_TMP_DIR))) {
                    trigger_error(sprintf('Invalid picture path `%s`', $input["_picture"]), E_USER_WARNING);
+                    return false;
                }
                if (Document::isImage($fullpath)) {
                    // Unlink old picture (clean on changing format)

Source: GLPI Commit 54306fa and GLPI Commit 78ec583

Detection Methods for CVE-2026-47679

Indicators of Compromise

PHP error log entries containing the string Invalid picture path generated by the trigger_error call in src/User.php.
Unexpected deletion of files owned by the GLPI web server user, especially outside the GLPI temporary upload directory.
Profile update HTTP requests where the _picture parameter contains path traversal sequences such as ../ or absolute paths referencing non-upload locations.

Detection Strategies

Review web server access logs for POST requests to the user profile update endpoint and correlate them with filesystem change events on the GLPI host.
Enable PHP error logging and alert on repeated E_USER_WARNING entries matching Invalid picture path from GLPI processes.
Inspect GLPI audit tables for unusual profile picture update activity from non-administrative accounts.

Monitoring Recommendations

Monitor file integrity on GLPI configuration directories, files/_log/, and session storage paths used by the web server account.
Collect PHP error logs centrally and generate alerts for Invalid picture path events, which indicate exploitation attempts both pre- and post-patch.
Track authenticated session activity in GLPI and flag accounts issuing high volumes of profile update requests.

How to Mitigate CVE-2026-47679

Immediate Actions Required

Upgrade GLPI to version 10.0.26 or 11.0.8, which add an explicit return false after the failed path-boundary check.
Audit the GLPI server for missing or recently deleted files, particularly configuration, cache, and log files.
Rotate any secrets stored in files writable by the GLPI process user if evidence of exploitation is found.

Patch Information

The maintainers released fixes in GLPI Release 10.0.26 and GLPI Release 11.0.8. The code change is tracked in GLPI Commit 54306fa and GLPI Commit 78ec583. Full details appear in GitHub Security Advisory GHSA-x5r8-r6vj-79cw.

Workarounds

Restrict access to the GLPI web interface to trusted internal networks or VPN until patching completes.
Reduce the filesystem privileges of the GLPI web server user so that it cannot delete files outside the GLPI data directories.
Temporarily disable self-service profile updates for non-administrative users where feasible.

bash

# Example: upgrade GLPI to the fixed release and verify version
cd /var/www/glpi
php bin/console glpi:maintenance:enable
# Replace application files with the 10.0.26 or 11.0.8 release archive, then:
php bin/console db:update
php bin/console glpi:maintenance:disable
php bin/console --version