CVE-2026-47679

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47679
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47679.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47679
Aliases
  • GHSA-x5r8-r6vj-79cw
Downstream
Published
2026-09-25T18:33:55Z
Modified
2026-10-21T02:58:15Z
Severity
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H CVSS Calculator
Summary
GLPI: arbitrary file deletion
Details

GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions 11.0.8 and 10.0.26.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47679.json"
}
References

Affected packages

Git / github.com/glpi-project/glpi

Affected ranges

Type
GIT
Repo
https://github.com/glpi-project/glpi
Events
Introduced
815997021a5df4feb7077a12f6f52769e9bd3459
Fixed
17b6d8de504deb8fa14825a86824f0f1cac9e10d
Introduced
b5cb4adb3c350521d85209d49e29e8619cdf8316
Fixed
1056d00af818ad2a99e3009a21a9db8c724ddc53
Fixed
54306faf6a724321ba82c53c7c07ff6612a0d832
Fixed
78ec583051bac3c1b3f9d21729c55cac62afa2f3
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "10.0.0"
                },
                {
                    "fixed":  "10.0.26"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "11.0.0"
                },
                {
                    "fixed":  "11.0.8"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "54306faf6a724321ba82c53c7c07ff6612a0d832"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "78ec583051bac3c1b3f9d21729c55cac62afa2f3"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "10.0.26",
            "range":  [
                {
                    "fixed":  "17b6d8de504deb8fa14825a86824f0f1cac9e10d"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "11.0.8",
            "range":  [
                {
                    "fixed":  "1056d00af818ad2a99e3009a21a9db8c724ddc53"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

10.*
10.0.0
10.0.1
10.0.10
10.0.11
10.0.12
10.0.13
10.0.14
10.0.15
10.0.16
10.0.17
10.0.18
10.0.19
10.0.2
10.0.20
10.0.21
10.0.22
10.0.23
10.0.24
10.0.25
10.0.3
10.0.4
10.0.5
10.0.6
10.0.7
10.0.8
10.0.9
11.*
11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
11.0.5
11.0.6
11.0.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47679.json"