Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN1091 _____________________________________________________________________ DATE : 27/10/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running glpi versions prior 10.0.27, 11.0.9. ==================================================================== https://github.com/glpi-project/glpi/security/advisories/GHSA-hv93-qr6v-7mpj https://github.com/glpi-project/glpi/security/advisories/GHSA-3rr2-mxv6-rmc2 https://github.com/glpi-project/glpi/security/advisories/GHSA-7x93-gxc8-jp8m https://github.com/glpi-project/glpi/security/advisories/GHSA-pr87-h373-xr6c https://github.com/glpi-project/glpi/security/advisories/GHSA-5jg3-2qx2-gq7g _____________________________________________________________________ Race condition in marketplace allowing malicious plugin installation High cedric-anne published GHSA-hv93-qr6v-7mpj Package glpi (glpi) Affected versions >= 9.5.0, < 11.0.0 >= 11.0.0 Patched versions 10.0.27 11.0.9 Description Impact A GLPI administrator can exploit a race condition to install a crafted plugin archive containing a malicious PHP executable that can be then executed on the server. Patches Upgrade to 10.0.27 or 11.0.9. For more information If you have any questions or comments about this advisory, mail us at glpi-security@ow2.org. Severity High 8.9/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity High Attack Requirements Present Privileges Required High User interaction None Vulnerable System Impact Metrics Confidentiality High Integrity High Availability High Subsequent System Impact Metrics Confidentiality High Integrity High Availability High CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVE ID No known CVE Weaknesses Weakness CWE-367 Weakness CWE-494 Credits @Bnyt7 Bnyt7 Finder @froozeify froozeify Remediation developer _____________________________________________________________________ MFA bypass via password reset High cedric-anne published GHSA-3rr2-mxv6-rmc2 Package glpi (glpi) Affected versions >= 11.0.0 Patched versions 11.0.9 Description Impact An attacker being able to steal the password reset token of a GLPI user will be able to login to GLPI with the user account without having to verify their identity through two-factor authentication. Patches Upgrade to 11.0.9. For more information If you have any questions or comments about this advisory, mail us at glpi-security@ow2.org. Severity High 8.6/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements None Privileges Required None User interaction Active Vulnerable System Impact Metrics Confidentiality High Integrity High Availability High Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE ID No known CVE Weaknesses No CWEs Credits @tediv-syn tediv-syn Finder @froozeify froozeify Remediation developer _____________________________________________________________________ Stored XSS via asset name High cedric-anne published GHSA-7x93-gxc8-jp8m Package glpi (glpi) Affected versions >= 11.0.0 Patched versions 11.0.9 Description Impact A technician can use a malicious payload to store a XSS into assets names. The XSS will be triggered when anyone will access the "used items" tab of a user attached to the corresponding assets. Patches Upgrade to 11.0.9. For more information If you have any questions or comments about this advisory, mail us at glpi-security@ow2.org. Severity High 8.5/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements None Privileges Required High User interaction Passive Vulnerable System Impact Metrics Confidentiality High Integrity High Availability High Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE ID No known CVE Weaknesses Weakness CWE-79 Credits @SebSept SebSept Reporter @isanghyeon isanghyeon Finder @360AlphaLab 360AlphaLab Finder _____________________________________________________________________ Upload of malicious page on the web-server High cedric-anne published GHSA-pr87-h373-xr6c Package glpi (glpi) Affected versions >= 9.3.0, < 11.0.0 >= 11.0.0 Patched versions 10.0.27 11.0.9 Description Impact An authenticated user with asset creation permissions can upload self-crafted files on the server, to any directory the web-server user can write. Only configured uploadable document types can be written on the server. The attacker can, for instance, upload a HTML file on the web-server to perform phishing attempts. Patches Upgrade to 10.0.27 and 11.0.9. For more information If you have any questions or comments about this advisory, mail us at glpi-security@ow2.org. Severity High / 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements None Privileges Required High User interaction Active Vulnerable System Impact Metrics Confidentiality High Integrity High Availability None Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVE ID No known CVE Weaknesses No CWEs Credits @SebSept SebSept Reporter _____________________________________________________________________ Unexpected X509 authentication success with unverified certificated High cedric-anne published GHSA-5jg3-2qx2-gq7g Package glpi (glpi) Affected versions >= 11.0.0 >= 0.71, < 11.0.0 Patched versions 11.0.9 10.0.27 Description Impact When the X509 authentication is enabled on GLPI and the web server uses an unsecure configuration, an attacker can craft a self-signed certificate to impersonate a legitimate user. Patches Upgrade to 10.0.27 or 11.0.9. Workaround Update Apache configuration to use SSLVerifyClient optional or SSLVerifyClient required instead of the unsecure SSLVerifyClient optional_no_ca configuration. For more information If you have any questions or comments about this advisory, mail us at glpi-security@ow2.org. Severity High 7.5/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Local Attack Complexity Low Attack Requirements Present Privileges Required None User interaction None Vulnerable System Impact Metrics Confidentiality High Integrity High Availability High Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE ID No known CVE Weaknesses No CWEs Credits @SebSept SebSept Analyst ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================