CVE-2026-47678: GLPI: Blind Time based SQLI in dropdowns
GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown values fetching endpoint that are incorporated into a database query. This permits SQL injection through the dropdown endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GLPIto a version that resolves this vulnerability.Fixed in 11.0.8 - Upgrade
Upgrade
GLPIto a version that resolves this vulnerability.Fixed in 10.0.26
Event History
Frequently Asked Questions
Which GLPI deployments are affected?
GLPI versions from 9.4.0 through 10.0.25 are affected, as are versions before 11.0.8 in the 11.x line. The issue is fixed in 10.0.26 and 11.0.8.
What access does an attacker need to exploit this issue?
An attacker must be authenticated as a GLPI user. They can submit crafted values to the dropdown values fetching endpoint, where the values are incorporated into a database query.
Are unauthenticated or cross-system attacks described?
No. The supplied vector requires low privileges and no user interaction, but it does not describe unauthenticated exploitation or impact on systems beyond the vulnerable GLPI instance.