GLPI CVE-2026-42317

The attacker must possess valid credentials for a GLPI account with the technician profile and be able to reach the GLPI web interface over the network (no user interaction is required, per CVSS UI:N). Deletion is limited to files for which the webserver process holds write permission on disk - so hardened deployments where GLPI's PHP user has write access only to its data directories will see a contained blast radius, while default Linux package installations where www-data owns much of the GLPI tree are fully exposed. Affects only GLPI versions 0.78 through 10.0.24 and 11.0.0 through 11.0.6; earlier 11.x preview builds and post-patch releases are out of scope.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:N/VI:H/VA:H) accurately frames this as network-reachable but requiring high privileges - specifically a valid technician account - with no user interaction, yielding high integrity and availability impact and no confidentiality impact, producing a 7.0 score. The Tags field labels it 'Authentication Bypass,' which conflicts with the CVSS PR:H rating and the description's wording that 'a technician can delete' files; the description implies abuse of legitimate technician privileges rather than a true auth bypass, so the tag appears mislabeled and the PR:H rating should be trusted. No EPSS score, KEV listing, or public POC is provided, so real-world exploitation is currently theoretical, but the impact is serious in multi-tenant or large-organization GLPI deployments where the technician role is widely delegated and could be used to delete GLPI's own config.php, break the application, or destroy audit logs.

A user holding a technician profile - for example, a help-desk operator or a compromised technician account obtained via phishing or credential reuse - authenticates to GLPI over the network and invokes the vulnerable file-handling endpoint with a crafted path pointing outside the managed storage area. The webserver, running as www-data or equivalent, unlinks the target file, allowing the attacker to destroy GLPI's config.php to deny service, wipe audit/ticket logs to hide prior activity, or delete plugin files to corrupt the application. No public exploit identified at time of analysis.