CVE-2026-49469: GLPI: LDAP filter injection in user import feature
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter was intended to exclude. This issue is fixed in versions 11.0.8 and 10.0.26.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GLPIto a version that resolves this vulnerability.Fixed in 11.0.8 - Upgrade
Upgrade
GLPIto a version that resolves this vulnerability.Fixed in 10.0.26
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated GLPI user with the hotliner or technician role can exploit it through the user import feature. Exploitation requires the ability to submit crafted import criteria.
What information could be exposed?
The issue can expose LDAP objects that the configured default LDAP filter was intended to exclude. The provided information does not specify the types of LDAP objects or attributes available after bypassing the filter.
Are all GLPI deployments affected?
Affected deployments are those running GLPI versions from 0.70 through 10.0.26 or 11.0.8 and using the LDAP-backed user import feature. The issue specifically concerns bypass of a configured default LDAP filter.
How can this be remediated?
Upgrade to a fixed release: GLPI 10.0.26 or GLPI 11.0.8. These versions address the LDAP filter injection in user import criteria.