GLPI: Remote Code Execution via Local File Inclusion (CVE-2025-24801)

GLPI versions prior to 10.0.18 contain a vulnerability (CVE-2025-24801) allowing Remote Code Execution (RCE) via Local File Inclusion. An authenticated user can interact with the front/documenttype.form.php endpoint and manipulate the ext parameter to permit the upload of unauthorized file types, such as PHP scripts. Successful exploitation results in arbitrary command execution on the host server.

Attack Chain

1. Attacker authenticates to the GLPI application with low-level privileges.
2. Attacker navigates to the front/documenttype.form.php endpoint.
3. Attacker modifies the allowed file extensions configuration for Document Types via the ext parameter in the request body.
4. Attacker uploads a malicious PHP file through the application's file upload interface.
5. The application saves the file to a location accessible by the web server.
6. Attacker triggers execution of the uploaded file by navigating to its path, resulting in RCE.

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary commands with the privileges of the web server, leading to full compromise of the GLPI application instance.

Recommendation

• Upgrade GLPI to version 10.0.18 or later immediately to patch CVE-2025-24801.
• Audit GLPI user accounts to identify and restrict low-privileged users with access to configuration-altering endpoints.
• Monitor web server logs for suspicious POST requests to front/documenttype.form.php and subsequent direct access to uploaded files in the web-accessible directories.