GLPI (< 10.0.27) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/glpi--10.0.27/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 17:39:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGLPI Multiple Vulnerabilitieshttps://feed.craftedsignal.io/briefs/2026-10-glpi-vulnerabilities/Tue, 27 Oct 2026 17:39:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-glpi-vulnerabilities/Multiple vulnerabilities in GLPI allow remote attackers to perform SQL injection, cross-site scripting, and security policy bypass, resulting in data integrity loss.The French National Cybersecurity Agency (ANSSI) has released an advisory regarding multiple vulnerabilities in the GLPI software. The identified flaws permit attackers to conduct SQL injection (SQLi) attacks, execute remote cross-site scripting (XSS), bypass security policies, and manipulate data integrity. These vulnerabilities affect GLPI versions 10.0.x prior to 10.0.27 and 11.0.x prior to 11.0.9.

Impact

Successful exploitation allows for unauthorized data manipulation, security policy circumvention, and the execution of malicious scripts in the context of user sessions.

Recommendation

  • Inventory all internal deployments of GLPI to identify affected versions.
  • Apply the latest security patches provided by the GLPI project by upgrading to versions 10.0.27 or 11.0.9 or later.
  • Refer to the security advisories published on the GLPI GitHub security page (GHSA-3rr2-mxv6-rmc2, GHSA-5jg3-2qx2-gq7g, GHSA-753w-2942-4pxm, GHSA-75jp-p2vm-9vmh, GHSA-7x93-gxc8-jp8m, GHSA-hv93-qr6v-7mpj, GHSA-pr87-h373-xr6c) for specific mitigation details per CVE.
]]>highadvisorywebserversql-injectionxsspatch-management