CVE-2026-42320: GLPI vulnerable to arbitrary file access

Q: What is the severity of CVE-2026-42320?

The severity of CVE-2026-42320 is medium with a CVSS score of 5.9.

Q: How do I fix CVE-2026-42320?

To address CVE-2026-42320, upgrade your GLPI software to version 10.0.25 or 11.0.7.

Q: What does CVE-2026-42320 affect?

CVE-2026-42320 affects versions of GLPI from 0.50 up to but not including 10.0.25 and 11.0.7.

Q: What is the impact of CVE-2026-42320?

The impact of CVE-2026-42320 is that unauthorized users can access arbitrary files within the GLPI_DOC_DIR.

Q: Is CVE-2026-42320 a critical vulnerability?

CVE-2026-42320 is not classified as critical; it has a medium severity rating.

Published Jun 3, 2026

Updated

GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 10.0.25 and 11.0.7, a technician can read arbitrary files inside the GLPIDOCDIR. Upgrade to 10.0.25 or 11.0.7 to receive a patch.

Affected Software

1 affected component

GLPI GLPI>=0.50<10.0.25, >=0.50<11.0.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GLPI to a version that resolves this vulnerability.
Fixed in 10.0.25
Upgrade
Upgrade GLPI to a version that resolves this vulnerability.
Fixed in 11.0.7

Event History

Jun 3, 2026

CVE Published

via MITRE·03:23 PM

Data Sourced

via MITRE·03:23 PM

DescriptionWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-42320?

The severity of CVE-2026-42320 is medium with a CVSS score of 5.9.

How do I fix CVE-2026-42320?

To address CVE-2026-42320, upgrade your GLPI software to version 10.0.25 or 11.0.7.

What does CVE-2026-42320 affect?

CVE-2026-42320 affects versions of GLPI from 0.50 up to but not including 10.0.25 and 11.0.7.

What is the impact of CVE-2026-42320?