Which versions of GLPI are affected by CVE-2026-42317?

GLPI asset management systems (versions 0.78-11.0.6) contain a flaw allowing authenticated technicians to delete any files accessible to the web server, threatening operational continuity and data…. A patch is available.

How to fix or mitigate CVE-2026-42317?

Within 24 hours: Identify all GLPI instances in production and document which are running versions 0.78-10.0.24 or 11.0.0-11.0.6. Within 7 days: Apply vendor patch (update affected instances to versions released beyond 10.0.24 for legacy track or 11.0.6 for current track). Within 30 days: Audit technician account activities for abnormal file deletion patterns and review access controls for the web process.

GLPI CVE-2026-42317

Q: What is the CVSS score of CVE-2026-42317?

CVE-2026-42317 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34105 HIGH

Missing Authorization (CWE-862)

2026-06-03 GitHub_M

Authentication Bypass Glpi Glpi Project

7.0

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 03, 2026 - 18:30 vuln.today

Patch available

Jun 03, 2026 - 17:01 EUVD

CVSS changed

Jun 03, 2026 - 16:22 NVD

7.0 (HIGH)

CVE Published

Jun 03, 2026 - 15:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, a technician can delete arbitrary files from the filesystem as long as the webserver has write rights on them. Upgrade to 10.0.25 or 11.0.7 to receive a patch.

AnalysisAI

Arbitrary file deletion in GLPI versions 0.78 through 10.0.24 and 11.0.0 through 11.0.6 allows authenticated technicians to remove any file on the webserver filesystem to which the web process has write permissions. The flaw is tracked as a missing authorization issue (CWE-862) and is tagged as an authentication bypass; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

GLPI is a widely deployed open-source IT asset and service management platform (CPE cpe:2.3:a:glpi-project:glpi) used for inventory, helpdesk, and ITIL-style workflows. The root cause is CWE-862 (Missing Authorization): a file-handling code path exposed to the technician role does not validate that the target path belongs to GLPI-managed storage, so any file writable by the webserver user (e.g., www-data) can be unlinked. Because GLPI typically runs under a PHP/Apache or PHP-FPM/nginx stack, the blast radius extends to GLPI configuration files, plugin code, cached data, log files, and any other content owned or writable by the web user on the host.

RemediationAI

Vendor-released patch: upgrade to GLPI 10.0.25 (for the 10.x line) or 11.0.7 (for the 11.x line) as directed in the upstream advisory at https://github.com/glpi-project/glpi/security/advisories/GHSA-jf72-cvjh-px5w. If patching cannot be performed immediately, restrict assignment of the technician profile to a minimal set of trusted accounts and audit existing technician memberships, since exploitation requires that role; additionally, tighten filesystem permissions so the webserver user only has write access to directories GLPI strictly needs (files/, plugins cache, session storage) and revoke write access to configuration and binary directories - note this can break plugin installs and self-update flows. Enabling filesystem-level auditing (auditd or equivalent) on the GLPI document root will not prevent the deletion but will provide forensic evidence.