CVE-2026-47679 glpi-project CVE debrief

Who should care

Defenders and administrators of GLPI installations should assess exposure and prioritize updating to fixed versions. This includes IT management teams, security personnel, and system administrators responsible for maintaining GLPI instances. Additionally, operators and users of GLPI installations should be aware of the potential risks and take necessary precautions to minimize impact. Vulnerability management and security teams should also review and

Why it matters

The CVE-2026-47679 vulnerability in GLPI allows logged-in users to request deletion of attacker-selected files. Defenders should prioritize verifying and updating GLPI installations, assessing exposure, and monitoring for potential file deletion requests.

• Verify and update GLPI installations to fixed versions to prevent potential file deletion.
• Assess exposure and monitor for potential file deletion requests to minimize impact.
• Adjust access controls and authentication mechanisms for GLPI instances to reduce risk.

Technical summary

The vulnerability in GLPI allows any logged-in user to exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue affects versions from 10.0.0 until 10.0.26 and 11.0.8. The vulnerability can be exploited by any authenticated user, potentially leading to unauthorized file deletion. Technical details indicate that the issue is related to improper validation of user-supplied input, allowing for path traversal attacks. The vulnerability has been fixed in versions 11.0.8 and 10.0.26, and defenders should prioritize updating to these versions.

Defensive priority

Defenders should prioritize verifying and updating GLPI installations to the fixed versions, assessing exposure, and monitoring for potential file deletion requests.

Recommended defensive actions

• Verify GLPI installations and update to fixed versions (11.0.8 or 10.0.26) if necessary.
• Assess exposure and monitor for potential file deletion requests.
• Review and adjust access controls and authentication mechanisms for GLPI instances.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed versions. Additional information on potential exploitation and impact is limited. Defenders should verify GLPI installations, assess exposure, and monitor for potential file deletion requests. Evidence from the CVE Program and NVD suggests that insufficient path validation in the profile-picture update flow allows logged-in users to request deletion of attacker-selected files. However, further details on exploitation and specific impacts on

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.