CVE-2026-48482 — GLPI: RCE via Form import
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that …
Published: 2026-09-25 · CVSS: 9.4 · CVSS 4.0
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location, allowing a malicious script to be invoked remotely. This issue is fixed in version 11.0.8.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7