GLPI (< 10.0.18)

GLPI versions before 10.0.18 are vulnerable to remote code execution through Local File Inclusion, where authenticated users can modify file extension allowlists to execute arbitrary PHP payloads.