CVE-2026-13490
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A security vulnerability has been detected in GLPI versions 11.0.5, 11.0.6, and 11.0.7 in the Document Handler component. The function Document::canViewFile in front/document.send.php improperly validates the docid argument, leading to authorization bypass. The attack can be executed remotely but is difficult to exploit due to high complexity.
Risk Assessment
Authorization bypass could allow an unauthorized attacker to access sensitive documents stored in GLPI, posing a risk of data leakage.
Recommendation
It is recommended to immediately apply patches provided by the GLPI vendor for versions 11.0.5, 11.0.6, and 11.0.7. Until the update, restrict access to the front/document.send.php file and monitor logs for suspicious requests.
Other vulnerabilities in GLPI
See all- CVE-2025-66417High
GLPI is a free asset and IT management software package. From version 11.0.0 to 11.0.2 (before 11.0.3), an unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in version 11.0.3.
- CVE-2025-64516High
GLPI prior to versions 10.0.21 and 11.0.3 allows an unauthorized user to access GLPI documents attached to any item (ticket, asset, etc.). If the public FAQ is enabled, this unauthorized access can be performed by an anonymous user. This vulnerability is fixed in 10.0.21 and 11.0.3.
- CVE-2017-11475High
GLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php.
- CVE-2016-7507High
Cross-Site Request Forgery (CSRF) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application.
- CVE-2016-7508High
Multiple SQL injection vulnerabilities in GLPI 0.90.4 allow an authenticated remote attacker to execute arbitrary SQL commands by using a certain character when the database is configured to use Big5 encoding.
- CVE-2015-7684High
In GLPI before version 0.85.3, there is an unrestricted file upload vulnerability that allows remote authenticated users to execute arbitrary code by adding a file with an executable extension as an attachment to a new ticket.
- CVE-2014-8360High
Directory traversal vulnerability in inc/autoload.function.php in GLPI before version 0.84.8 allows remote attackers to include and execute arbitrary local files via a .._ (dot dot underscore) in an item type passed to the getItemForItemtype function.
- CVE-2013-2226High
Multiple SQL injection vulnerabilities in GLPI before version 0.83.9 allow remote attackers to execute arbitrary SQL commands through various parameters in the application.
- CVE-2026-48482Critical
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location, allowing a malicious script to be invoked remotely. This issue is fixed in version 11.0.8.
- CVE-2022-35914CriticalActively exploited
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
Original NVD description (English source)
A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7. This affects the function Document::canViewFile of the file front/document.send.php of the component Document Handler. Such manipulation of the argument docid leads to authorization bypass. The attack can be executed remotely. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS