CVE-2026-47679 GLPI: arbitrary file deletion
Logged-in users can delete arbitrary server files via path traversal in profile picture updates, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-47679?
CVE-2026-47679 is a high-severity path traversal vulnerability in glpi-project glpi, published on 25 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions 11.0.8 and 10.0.26.
Weakness: CWE-22
Which versions are affected by CVE-2026-47679?
How do I fix CVE-2026-47679?
No fix has been published for CVE-2026-47679 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-47679 being exploited?
There is no known exploitation of CVE-2026-47679 in the wild and no public exploit code.
Sources
Also known as GHSA-x5r8-r6vj-79cw, UBUNTU-CVE-2026-47679.