CVE-2026-48482 glpi-project CVE debrief

Who should care

GLPI administrators and users, IT management software package administrators, and security teams responsible for asset management and vulnerability remediation should assess exposure and apply the patch.

Why it matters

CVE-2026-48482 is a critical vulnerability in GLPI that allows remote code execution, requiring immediate attention from administrators and security teams to assess exposure and apply the patch.

• Remote code execution is possible, allowing attackers to gain control of the server.
• The vulnerability can be exploited by an administrator with access to the form import feature.
• The issue requires immediate attention to prevent potential exploitation.
• Verification of GLPI versions and patch application is necessary to mitigate the vulnerability.

Technical summary

The vulnerability exists in GLPI from version 11.0.0 until 11.0.8, allowing an administrator to import a crafted illustration or scene identifier that can be written to an executable server location, enabling remote invocation of a malicious script. This issue requires immediate attention to prevent potential exploitation. Verification of GLPI versions and patch application is necessary to mitigate the vulnerability. The vulnerability allows remote code execution, requiring immediate attention from administrators and security teams to assess exposure and apply the patch.

Defensive priority

Immediate attention is required to assess exposure and apply the patch, as this vulnerability allows remote code execution.

Recommended defensive actions

• Assess exposure by reviewing GLPI versions in use and verifying if they are prior to 11.0.8.
• Apply the patch by updating to GLPI version 11.0.8 or later.
• Monitor for suspicious activity related to GLPI installations.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its critical severity and the fixed version. The vulnerability exists in GLPI from version 11.0.0 until 11.0.8, allowing an administrator to import a crafted illustration or scene identifier that can be written to an executable server location, enabling remote invocation of a malicious script. Evidence is limited to CVE and NVD entries; defenders should verify GLPI versions and patch status with official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.