EN PT-BR
← Voltar ao feed
high

CERT-FR warns of multiple GLPI vulnerabilities including SQL injection and XSS (CERTFR-2026-AVI-1389)

1 fonte(s) · 1 atualização(ões) · publicado 26/10/2026 21:00 · coletado há 4 dias

CERT-FR published advisory CERTFR-2026-AVI-1389 on 27 October 2026 covering multiple vulnerabilities in GLPI, the open-source IT asset and service management platform. According to the advisory, some flaws allow an attacker to compromise data integrity, bypass the security policy, and carry out SQL injection (SQLi) and indirect remote code injection (XSS). The affected versions are GLPI 11.0.x before 11.0.9 and GLPI versions before 10.0.27. The advisory does not report active exploitation and gives no CVE identifiers, CVSS scores or IOCs. It points to seven GitHub security advisories from the vendor, all dated 26 October 2026.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1389 covers multiple vulnerabilities in GLPI, the open-source IT asset and service management platform. According to the advisory, some flaws let an attacker breach data integrity, bypass the security policy, carry out SQL injection and perform indirect remote code injection (XSS). Affected versions are GLPI 11.0.x before 11.0.9 and GLPI before 10.0.27; the fixes are 11.0.9 and 10.0.27. The advisory gives no CVE IDs, CVSS scores, per-flaw severity, or details on required authentication or user interaction.

Como funciona

The articles do not describe how each vulnerable process works. They only name the impact classes: SQL injection, where input reaches a database query, and XSS, where content is returned to a user's browser as active code. They do not say which GLPI component, input or step is involved in each of the seven flaws. The vendor's GitHub advisories are the place to look for those details.

Por que é vulnerável

The advisory gives no root cause for any of the flaws. The listed impact classes (SQL injection, XSS, security policy bypass, integrity breach) point to input-handling and access-control weaknesses in general, but the articles do not confirm which applies to which flaw. They also do not say why the issues went unnoticed or what the fixes change beyond shipping in GLPI 11.0.9 and 10.0.27.

Onde está

No file, function or commit is named; the flaws are documented in seven GLPI GitHub security advisories dated 26 October 2026: GHSA-3rr2-mxv6-rmc2, GHSA-5jg3-2qx2-gq7g, GHSA-753w-2942-4pxm, GHSA-75jp-p2vm-9vmh, GHSA-7x93-gxc8-jp8m, GHSA-hv93-qr6v-7mpj and GHSA-pr87-h373-xr6c.

Como foi descoberta

The articles do not say who found the flaws or how. The vendor published seven GitHub security advisories on 26 October 2026, and CERT-FR issued its advisory on 27 October 2026 pointing to them. The advisory does not report active exploitation.

Explicação gerada por IA a partir da matéria e dos artigos, em 28/10/2026 14:26.

Detalhes técnicos

  • Impacts listed: data integrity breach, security policy bypass, SQL injection, indirect remote code injection (XSS).
  • Affected: GLPI 11.0.x earlier than 11.0.9 and versions earlier than 10.0.27.
  • Vendor advisories: GHSA-3rr2-mxv6-rmc2, GHSA-5jg3-2qx2-gq7g, GHSA-753w-2942-4pxm, GHSA-75jp-p2vm-9vmh, GHSA-7x93-gxc8-jp8m, GHSA-hv93-qr6v-7mpj, GHSA-pr87-h373-xr6c.
  • The advisory gives no per-flaw root cause, attack vector or severity.

Remediação

  • Consult the GLPI security bulletins for the fixes, as CERT-FR directs.
  • Update GLPI to 11.0.9 or later on the 11.0 branch, or to 10.0.27 or later on the 10.0 branch.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 26/10/2026 21:00 · coletado 28/10 14:01 primeiro registro

    CERT-FR warns of multiple GLPI vulnerabilities including SQL injection and XSS (CERTFR-2026-AVI-1389)

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1389 on 27 October 2026 covering multiple vulnerabilities in GLPI, the open-source IT asset and service management platform. According to the advisory, some flaws allow an attacker to compromise data integrity, bypass the security policy, and carry out SQL injection (SQLi) and indirect remote code injection (XSS). The affected versions are GLPI 11.0.x before 11.0.9 and GLPI versions before 10.0.27. The advisory does not report active exploitation and gives no CVE identifiers, CVSS scores or IOCs. It points to seven GitHub security advisories from the vendor, all dated 26 October 2026.

    Technical Details

    • Impacts listed: data integrity breach, security policy bypass, SQL injection, indirect remote code injection (XSS).
    • Affected: GLPI 11.0.x earlier than 11.0.9 and versions earlier than 10.0.27.
    • Vendor advisories: GHSA-3rr2-mxv6-rmc2, GHSA-5jg3-2qx2-gq7g, GHSA-753w-2942-4pxm, GHSA-75jp-p2vm-9vmh, GHSA-7x93-gxc8-jp8m, GHSA-hv93-qr6v-7mpj, GHSA-pr87-h373-xr6c.
    • The advisory gives no per-flaw root cause, attack vector or severity.

    Remediation

    • Consult the GLPI security bulletins for the fixes, as CERT-FR directs.
    • Update GLPI to 11.0.9 or later on the 11.0 branch, or to 10.0.27 or later on the 10.0 branch.