CERT-FR Advisory: Multiple Vulnerabilities in GLPI Allow Privilege Escalation and XSS
CERT-FR published advisory CERTFR-2026-AVI-1444 on 03 November 2026 describing multiple vulnerabilities in GLPI, an open-source IT asset management platform. The flaws affect GLPI versions 11.0.x prior to 11.0.10 and versions prior to 10.0.28, and allow an attacker to achieve privilege escalation, perform remote indirect code injection (XSS), and bypass security policy mechanisms. The advisory references three GLPI project security bulletins published on the GitHub Security Advisory database on 02 November 2026 (GHSA-47mc-679g-2jrv, GHSA-5pgp-cfq7-4j9h, GHSA-c46f-4v9j-5gpc). CERT-FR directs administrators to the vendor's bulletins for the applicable patches.
Entenda a falha
A vulnerabilidade
CERT-FR reports multiple vulnerabilities in GLPI, the open-source IT asset management platform. They allow privilege escalation, remote indirect code injection (XSS) and a bypass of the security policy. Affected versions are GLPI 11.0.x before 11.0.10 and GLPI before 10.0.28; the fixes are in the vendor's patched releases. The advisory gives no CVE IDs and does not say which flaw is in which component, what access or authentication an attacker needs, or how severe each one is. Details are in three GLPI bulletins: GHSA-47mc-679g-2jrv, GHSA-5pgp-cfq7-4j9h and GHSA-c46f-4v9j-5gpc.
Como foi descoberta
CERT-FR advisory CERTFR-2026-AVI-1444, dated 3 November 2026, says only that multiple vulnerabilities "have been discovered" in GLPI. It does not say who found them or how. The GLPI project published the three security bulletins on GitHub on 2 November 2026, and CERT-FR points administrators to them for the patches.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 14:25.
Detalhes técnicos
- Vulnerabilities include privilege escalation, remote indirect XSS injection, and security policy bypass.
- Affected: GLPI 11.0.x prior to 11.0.10, and versions prior to 10.0.28.
- Referenced vendor advisories: GHSA-47mc-679g-2jrv, GHSA-5pgp-cfq7-4j9h, GHSA-c46f-4v9j-5gpc (published 02 November 2026).
Remediação
- Apply the patches referenced in the GLPI project security advisories.
Linha do tempo
-
CERT-FR Advisory: Multiple Vulnerabilities in GLPI Allow Privilege Escalation and XSS
ler a análise desta fonte ocultar
CERT-FR published advisory CERTFR-2026-AVI-1444 on 03 November 2026 describing multiple vulnerabilities in GLPI, an open-source IT asset management platform. The flaws affect GLPI versions 11.0.x prior to 11.0.10 and versions prior to 10.0.28, and allow an attacker to achieve privilege escalation, perform remote indirect code injection (XSS), and bypass security policy mechanisms. The advisory references three GLPI project security bulletins published on the GitHub Security Advisory database on 02 November 2026 (GHSA-47mc-679g-2jrv, GHSA-5pgp-cfq7-4j9h, GHSA-c46f-4v9j-5gpc). CERT-FR directs administrators to the vendor's bulletins for the applicable patches.
Technical Details
- Vulnerabilities include privilege escalation, remote indirect XSS injection, and security policy bypass.
- Affected: GLPI 11.0.x prior to 11.0.10, and versions prior to 10.0.28.
- Referenced vendor advisories: GHSA-47mc-679g-2jrv, GHSA-5pgp-cfq7-4j9h, GHSA-c46f-4v9j-5gpc (published 02 November 2026).
Remediation
- Apply the patches referenced in the GLPI project security advisories.