GLPI Form import remote code execution fixed in 11.0.8 (CVE-2026-48482, GHSA-6whc-g4h2-98rm)

What happened

GLPI's 11.0.8 release bundles fixes for the vulnerabilities described here, and GLPI 10.0.26 fixes those that affect the 10.0 series. The advisory GHSA-6whc-g4h2-98rm covers CVE-2026-48482, a critical remote code execution flaw: a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location, allowing a malicious script to be invoked remotely. CVE-2026-52848, an unauthenticated MFA bypass, has its own page on this site.

The other vulnerabilities fixed in these releases include authenticated SQL injection in the dropdown and history-tab endpoints, arbitrary file deletion through profile-picture updates, stored cross-site scripting in supplier website fields, reflected cross-site scripting in dashboards, missing rate limiting on TOTP verification that enables brute-force account takeover, privilege escalation through authtype API manipulation, and a permission logic flaw that can expose documents to users who should not view them. The CVE records do not record exploitation or public disclosure for these flaws.

Who is affected

GLPI is self-hosted asset and IT management software. Fixed releases are 11.0.8 and 10.0.26. The Form import RCE, the missing TOTP rate limiting and the reflected dashboard XSS affect versions from 11.0.0 before 11.0.8. The supplier stored XSS affects versions from 11.0.6 before 11.0.8. The dropdown and history-tab SQL injection, arbitrary file deletion, privilege escalation and document exposure affect versions from 11.0.0 before 11.0.8 and are also fixed in 10.0.26. On the 10.0 series, the SQL injection issues reach back to 9.4.0, privilege escalation to 0.70 and document exposure to 0.85; arbitrary file deletion affects versions from 10.0.0 before 10.0.26.

What to do now

1. Upgrade to a fixed release: 11.0.8 for GLPI versions from 11.0.0 before 11.0.8, and 10.0.26 for versions from 10.0.0 before 10.0.26. If your installation is on an older affected 10.0-series version (for example, from 9.4.0, 0.70 or 0.85), upgrade to 10.0.26.
2. GLPI has not published workarounds for these issues. Until you can upgrade, restrict access to the GLPI web interface and API to trusted networks and monitor authentication events.
3. After upgrading, review user authentication method settings for unexpected changes and check for recently written files in web-accessible directories.
4. Test the upgrade in a staging environment before deploying to production if you use custom plugins or themes.

How to detect it

No vendor indicators of compromise are published. From the flaw descriptions, review GLPI logs for unusual requests to the dropdown and history-tab endpoints, changes to user authentication methods or supplier website fields, and creation of files in directories served by the web server. Monitor login events for repeated TOTP failures or logins that bypass MFA.

Beyond the patch

This group of issues in a self-managed open-source platform is a reminder that the hardening work cannot stop at installation. Several of these flaws are the exact class a penetration test and hardening assessment finds before they are exploited, from SQL injection to path traversal. The fix only changes your exposure when you apply it, so release tracking belongs in your third-party and supply-chain risk programme. If you suspect any of these were used before patching, an incident response retainer means help is already arranged.