GLPI CVE-2026-42320

Exploitation requires an authenticated GLPI account with at minimum technician-level privileges, as confirmed by CVSS 4.0 PR:H. The attack is conducted over the network (AV:N) without requiring additional user interaction (UI:N), but AC:H indicates non-trivial conditions or steps are involved beyond simply having credentials - the exact complexity factor is not described in available data and should be verified against the full advisory. Exploitation is limited to reading files within the GLPI_DOC_DIR boundary; arbitrary filesystem traversal outside that directory is not claimed. What limits exploitation: the attacker must have a pre-existing technician account (not an unauthenticated path), high attack complexity reduces opportunistic mass exploitation, and the impact is read-only with no write or execution capability. SSVC confirms the attack is not automatable.

The CVSS 4.0 score of 5.9 (Medium) reflects meaningful constraints on exploitability: PR:H requires the attacker to already hold a high-privilege technician account, and AC:H indicates elevated attack complexity, suggesting the file read mechanism is not trivially triggered. The impact is limited strictly to confidentiality (VC:H) with no integrity or availability consequences, and there is no scope change to subsequent system components (SC:N/SI:N/SA:N). SSVC reinforces this measured view - exploitation status is none, the attack is not automatable, and technical impact is rated partial. No EPSS score was provided, and the vulnerability does not appear in the CISA KEV catalog, further supporting a lower urgency posture for most organizations. The primary real-world risk is insider threat or compromised technician accounts leading to sensitive document exfiltration. Organizations with strict need-to-know controls on their GLPI document store should treat this as higher priority than the base CVSS score suggests.

An attacker with a valid GLPI technician account - obtained through credential theft, phishing, or abuse of an insider account - sends a crafted request targeting the document retrieval mechanism, specifying a file path within GLPI_DOC_DIR that the technician would not normally be authorized to access. Because the authorization check is absent (CWE-862), the server returns the file contents directly, allowing the attacker to read sensitive documents stored in the directory. No public exploit code is known at this time, and the high attack complexity (AC:H) suggests the precise request format or triggering condition is non-obvious.