{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aglpi-projectglpi/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.5,"id":"CVE-2025-24801"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GLPI (\u003c 10.0.18)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Glpi-project"],"content_html":"\u003cp\u003eGLPI versions prior to 10.0.18 contain a vulnerability (CVE-2025-24801) allowing Remote Code Execution (RCE) via Local File Inclusion. An authenticated user can interact with the \u003ccode\u003efront/documenttype.form.php\u003c/code\u003e endpoint and manipulate the \u003ccode\u003eext\u003c/code\u003e parameter to permit the upload of unauthorized file types, such as PHP scripts. Successful exploitation results in arbitrary command execution on the host server.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the GLPI application with low-level privileges.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the \u003ccode\u003efront/documenttype.form.php\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker modifies the allowed file extensions configuration for Document Types via the \u003ccode\u003eext\u003c/code\u003e parameter in the request body.\u003c/li\u003e\n\u003cli\u003eAttacker uploads a malicious PHP file through the application's file upload interface.\u003c/li\u003e\n\u003cli\u003eThe application saves the file to a location accessible by the web server.\u003c/li\u003e\n\u003cli\u003eAttacker triggers execution of the uploaded file by navigating to its path, resulting in RCE.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker to execute arbitrary commands with the privileges of the web server, leading to full compromise of the GLPI application instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade GLPI to version 10.0.18 or later immediately to patch CVE-2025-24801.\u003c/li\u003e\n\u003cli\u003eAudit GLPI user accounts to identify and restrict low-privileged users with access to configuration-altering endpoints.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious POST requests to \u003ccode\u003efront/documenttype.form.php\u003c/code\u003e and subsequent direct access to uploaded files in the web-accessible directories.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T14:37:42Z","date_published":"2026-10-29T14:37:42Z","id":"https://feed.craftedsignal.io/briefs/2026-10-glpi-rce/","summary":"GLPI versions before 10.0.18 are vulnerable to remote code execution through Local File Inclusion, where authenticated users can modify file extension allowlists to execute arbitrary PHP payloads.","title":"GLPI: Remote Code Execution via Local File Inclusion (CVE-2025-24801)","url":"https://feed.craftedsignal.io/briefs/2026-10-glpi-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:glpi-Project:glpi:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}