CVE-2026-52848

From 0.85 until 10.0.26 and from 11.0.0 until 11.0.8, GLPI permission logic could grant a user access to a document without confirming that the document was linked to the targeted item. This could expose the file to a user who should not be able to view it.

In GLPI, any authenticated user could submit a crafted request to change the visibility of knowledge base items, reminders, or RSS feeds and then access content that should remain restricted. The vulnerability exists from 0.83 until 10.0.27 and from 11.0.0 until 11.0.9.

From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown values fetching endpoint that are incorporated into a database query. This permits SQL injection through the dropdown endpoint.

GLPI is a free asset and IT management software package. From version 11.0.0 to 11.0.2 (before 11.0.3), an unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in version 11.0.3.

GLPI prior to versions 10.0.21 and 11.0.3 allows an unauthorized user to access GLPI documents attached to any item (ticket, asset, etc.). If the public FAQ is enabled, this unauthorized access can be performed by an anonymous user. This vulnerability is fixed in 10.0.21 and 11.0.3.

GLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php.

Cross-Site Request Forgery (CSRF) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application.

Multiple SQL injection vulnerabilities in GLPI 0.90.4 allow an authenticated remote attacker to execute arbitrary SQL commands by using a certain character when the database is configured to use Big5 encoding.

In GLPI before version 0.85.3, there is an unrestricted file upload vulnerability that allows remote authenticated users to execute arbitrary code by adding a file with an executable extension as an attachment to a new ticket.

Directory traversal vulnerability in inc/autoload.function.php in GLPI before version 0.84.8 allows remote attackers to include and execute arbitrary local files via a .._ (dot dot underscore) in an item type passed to the getItemForItemtype function.