CVE-2026-22248 GLPI affected by Remote Code Execution via malicious upload
Authenticated technicians can achieve remote code execution in GLPI by uploading malicious files that trigger unsafe PHP instantiation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-22248?
CVE-2026-22248 is a high-severity unsafe deserialization vulnerability in glpi-project glpi, published on 11 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. From 11.0.0 to before 11.0.5, an authenticated technician user can upload a malicious file and trigger its execution through an unsafe PHP instantiation. This vulnerability is fixed in 11.0.5.
Weakness: CWE-502
Which versions are affected by CVE-2026-22248?
It affects 1 product.
Products include Teclib-Edition Glpi.
How do I fix CVE-2026-22248?
No fix has been published for CVE-2026-22248 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-22248 being exploited?
There is no known exploitation of CVE-2026-22248 in the wild and no public exploit code.
Other vulnerabilities in glpi-project glpi
Sources
Also known as GHSA-c9q3-mcxq-9vr4, UBUNTU-CVE-2026-22248.