Attack Chain

1. Attacker authenticates to the GLPI application with low-level privileges.
2. Attacker navigates to the front/documenttype.form.php endpoint.
3. Attacker modifies the allowed file extensions configuration for Document Types via the ext parameter in the request body.
4. Attacker uploads a malicious PHP file through the application's file upload interface.
5. The application saves the file to a location accessible by the web server.
6. Attacker triggers execution of the uploaded file by navigating to its path, resulting in RCE.

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary commands with the privileges of the web server, leading to full compromise of the GLPI application instance.

Recommendation

• Upgrade GLPI to version 10.0.18 or later immediately to patch CVE-2025-24801.
• Audit GLPI user accounts to identify and restrict low-privileged users with access to configuration-altering endpoints.
• Monitor web server logs for suspicious POST requests to front/documenttype.form.php and subsequent direct access to uploaded files in the web-accessible directories.