CVE-2026-48482: GLPI Path Traversal Vulnerability

CVE-2026-48482 Overview

GLPI is a widely deployed open-source asset and IT management platform. CVE-2026-48482 is a path traversal vulnerability [CWE-22] in the Form import feature affecting versions 11.0.0 through 11.0.7. A form administrator can craft an illustration or scene identifier that escapes the intended custom-asset directory. The imported file is written to an executable server location, where it can be invoked remotely to run arbitrary code. The GLPI project resolved the issue in version 11.0.8.

Critical Impact
Authenticated form administrators can write arbitrary files to executable web paths, achieving remote code execution and full compromise of the GLPI server.

Affected Products

GLPI 11.0.0 through 11.0.7
FormSerializer component in src/Glpi/Form/Export/Serializer/FormSerializer.php
IllustrationManager component in src/Glpi/UI/IllustrationManager.php

Discovery Timeline

2026-09-25 - CVE-2026-48482 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-48482

Vulnerability Analysis

The vulnerability resides in GLPI's Form import workflow, specifically in how the application processes custom illustration and scene identifiers during deserialization. The saveCustomIllustration() and saveCustomScene() methods in IllustrationManager.php concatenated an attacker-supplied $id directly into a destination path and invoked PHP's rename() without validating that the resulting path remained within the designated custom-asset directory.

Because the identifier is embedded in a form export file controlled by the attacker, a form administrator who imports a malicious bundle can place arbitrary content at any filesystem location writable by the web server process. When the attacker targets a PHP-executable directory inside the GLPI web root, the uploaded payload becomes directly reachable through an HTTP request, yielding remote code execution.

Root Cause

The root cause is missing canonicalization of user-controlled file paths before a filesystem write. The vulnerable code trusted the identifier supplied through the imported form and did not call realpath() or enforce a prefix check against the custom asset directory, enabling traversal sequences such as ../../ to escape the intended folder.

Attack Vector

Exploitation requires authenticated access with form administrator privileges. The attacker constructs a form export file containing a crafted illustration or scene identifier that traverses out of CUSTOM_ILLUSTRATION_DIR or CUSTOM_SCENES_DIR. After importing the form through the GLPI web interface, the embedded payload is written to the attacker-chosen location and subsequently invoked over HTTP.

php

// Patch: src/Glpi/UI/IllustrationManager.php
 public function saveCustomIllustration(string $id, string $path): void
 {
-    rename($path, self::CUSTOM_ILLUSTRATION_DIR . "/$id");
+    $dest = self::CUSTOM_ILLUSTRATION_DIR . "/$id";
+    $real_dest = realpath(dirname($dest)) . DIRECTORY_SEPARATOR . basename($dest);
+    if (!str_starts_with($real_dest, realpath(self::CUSTOM_ILLUSTRATION_DIR) . DIRECTORY_SEPARATOR)) {
+        throw new RuntimeException("Illustration path traversal detected: $id");
+    }
+    rename($path, $dest);
 }

 public function saveCustomScene(string $id, string $path): void
 {
-    rename($path, self::CUSTOM_SCENES_DIR . "/$id");
+    $dest = self::CUSTOM_SCENES_DIR . "/$id";
+    $real_dest = realpath(dirname($dest)) . DIRECTORY_SEPARATOR . basename($dest);
+    if (!str_starts_with($real_dest, realpath(self::CUSTOM_SCENES_DIR) . DIRECTORY_SEPARATOR)) {
+        throw new RuntimeException("Scene path traversal detected: $id");
+    }
+    rename($path, $dest);
 }
// Source: https://github.com/glpi-project/glpi/commit/d817cb5c17e3368c89d4a561a43a777662b9da19

The patched code resolves the real destination path and rejects any identifier whose canonical path falls outside the custom asset directory.

Detection Methods for CVE-2026-48482

Indicators of Compromise

Unexpected files, especially .php payloads, appearing outside files/_pictures/custom_illustrations/ or files/_pictures/custom_scenes/ after a Form import operation.
Form import audit entries referencing illustration or scene identifiers containing ../, ..\, or URL-encoded traversal sequences.
Web server access logs showing GET or POST requests to newly created files immediately after a form administrator session.

Detection Strategies

Review GLPI application logs for Form import events and correlate with filesystem change events in the web root.
Scan the GLPI installation directory for PHP files that are not part of the official 11.0.x distribution hash set.
Alert on rename() or file creation activity by the web server user that targets paths outside the designated custom asset directories.

Monitoring Recommendations

Enable file integrity monitoring on the GLPI web root and files/_pictures/ subdirectories.
Centralize PHP-FPM and web server logs to detect requests to anomalous script paths following administrative sessions.
Monitor privileged GLPI accounts, particularly those with form administration rights, for unusual import activity.

How to Mitigate CVE-2026-48482

Immediate Actions Required

Upgrade GLPI to version 11.0.8 or later without delay.
Audit form administrator accounts and remove the privilege from any user who does not require it.
Inspect the GLPI web root for unauthorized PHP files written since the deployment of a vulnerable 11.0.x release.

Patch Information

The fix is included in GitHub Release 11.0.8. The code change is documented in the GitHub Commit Update and the GitHub Security Advisory GHSA-6whc-g4h2-98rm. The patch introduces realpath()-based canonicalization and a prefix check in saveCustomIllustration() and saveCustomScene().

Workarounds

Restrict the Form import feature to a minimal set of trusted administrators until the patch is applied.
Configure the web server to deny PHP execution within the files/ directory tree where custom assets are stored.
Deploy a reverse proxy or WAF rule that blocks multipart form imports containing traversal sequences in illustration or scene identifier fields.

bash

# Example Apache configuration to deny PHP execution in GLPI files directory
<Directory "/var/www/glpi/files">
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
    php_admin_flag engine off
</Directory>