GLPI 11.0.9 fixes unauthenticated SQL injection, marketplace race condition and other high-severity flaws

What happened

GLPI's 11.0.9 release bundles fixes for ten GitHub security advisories. Among them, GHSA-753w-2942-4pxm is an unauthenticated time-based SQL injection in the planning feature. An attacker can query the application over the network with no account and no user interaction, giving a high confidentiality impact on the GLPI instance.

GHSA-hv93-qr6v-7mpj is a race condition in the marketplace: a GLPI administrator can install a crafted plugin archive containing a malicious PHP executable that can then be executed on the server. GHSA-m9x5-44w4-jj4g lets a user with document creation rights delete arbitrary files on the web server, and GHSA-pr87-h373-xr6c lets a user with asset creation permissions upload crafted files, such as HTML for phishing, to any directory the web-server user can write.

Several stored cross-site scripting flaws affect form illustrations, ticket actors, asset names and network equipment models. Two further advisories weaken multifactor authentication: GHSA-3rr2-mxv6-rmc2 allows a stolen password reset token to be used without the second factor, and GHSA-rvrc-4jr9-wm5c lets another GLPI user apply their own 2FA secret after learning a victim's credentials. GLPI has not stated that any of these flaws is exploited in the wild, and none is listed in CISA's KEV.

Who is affected

GLPI is the affected product, typically used for IT asset and service desk management. The advisories list these affected ranges:

• GLPI 11.0.0 to before 11.0.9 for most flaws; the unauthenticated planning SQL injection affects GLPI 11.0.8 to before 11.0.9.
• The marketplace race condition also affects GLPI 9.5.0 to before 10.0.27; arbitrary file deletion also affects GLPI 0.78 to before 10.0.27; malicious page upload also affects GLPI 9.3.0 to before 10.0.27.
• The MFA bypass by another GLPI user lists affected releases before 11.0.9.

What to do now

1. Upgrade GLPI 11.0 deployments to GLPI 11.0.9. This release fixes all ten advisories described here.
2. If your deployment is on an affected release in the ranges 9.5.0 to before 10.0.27, 0.78 to before 10.0.27, or 9.3.0 to before 10.0.27 — and you cannot move to 11.0.9 immediately — upgrade to GLPI 10.0.27 for the three advisories that list that fix: GHSA-hv93-qr6v-7mpj, GHSA-m9x5-44w4-jj4g and GHSA-pr87-h373-xr6c. The other seven advisories do not list a fix before 11.0.9.
3. No workarounds are published in these advisories. Until patching, restrict network access to GLPI, especially the planning feature and any internet-facing service desk, and review accounts with form import, asset creation, document creation or administrative permissions.
4. After upgrading, monitor for unexpected plugin installations, new PHP files in directories writable by the web-server user, unusual database activity, and unexpected HTML or script content in ticket, asset and model fields.

How to detect it

Because GHSA-753w-2942-4pxm is a time-based SQL injection, look for repeated or automated requests to planning endpoints that take longer than usual. For the marketplace race condition, check for unexpected plugin installations or new PHP files under directories writable by the web server. For the stored XSS flaws, review recently modified tickets, asset names, network equipment models and form illustrations for unexpected HTML or script content.

Beyond the patch

GLPI often holds sensitive asset, ticket and identity data, and this bundle includes unauthenticated SQL injection and MFA bypass. Patching is the immediate step, but the fact that one release carries ten high-severity advisories is a reminder to know where GLPI sits in your environment and how quickly vendor fixes reach it. Our Implementation & Assessment Services can penetration-test and harden GLPI deployments, and Supply Chain Defense & Third-Party Risk helps track vendor patch cycles so your exposure window does not silently lengthen.