CVE-2026-42317: GLPI vulnerable to arbitrary files deletion by technician

Synopsis

An arbitrary file deletion vulnerability affects GLPI, the open-source IT asset management platform, in all versions from 0.78 up to (but not including) 10.0.25 and 11.0.7. The flaw is reachable over the network and requires only a technician-level account, a low-privilege role common in GLPI deployments. Successful exploitation lets an attacker delete any file on the server filesystem that the web server process has write access to, causing data loss or service disruption. No fix versions have been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the GLPI web service from across the network.

• AuthenticationRequired

  A technician-level account (or higher) is required; any low-privilege user holding that role is sufficient to trigger the vulnerability.

• Victim interactionNot required

  No victim interaction is needed; the attacker can exploit the flaw directly without involving another user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is straightforward and reliable with no race conditions or special environmental setup required.

Blast Radius

• An attacker deletes arbitrary files on the server filesystem wherever the web server process holds write permissions.
• Deleting application or configuration files disrupts the GLPI service, making IT asset management unavailable to the organization.
• Deletion of log or audit files destroys forensic evidence, complicating incident response after an attack.
• Critical data files such as uploaded attachments or plugin assets can be permanently removed with no built-in recovery path.