UBUNTU-CVE-2026-47678: SQL Injection

Published Nov 5, 2026

Updated

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown values fetching endpoint that are incorporated into a database query. This permits SQL injection through the dropdown endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.

Affected Software

1 affected component

ubuntu/glpi*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GLPI to a version that resolves this vulnerability.
Fixed in 11.0.8

Event History

Nov 5, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated to GLPI. Any authenticated user can submit crafted values to the dropdown values fetching endpoint.

Which GLPI versions are affected and which versions contain the fix?

The issue affects GLPI from 9.4.0 through versions before 10.0.26 and 11.0.8. It is fixed in 10.0.26 and 11.0.8.

What is the impact of successful exploitation?

Successful exploitation permits SQL injection through the dropdown endpoint. The reported vector indicates high impact to the confidentiality, integrity, and availability of the vulnerable system.

UBUNTU-CVE-2026-47678: SQL Injection

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which GLPI versions are affected and which versions contain the fix?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which GLPI versions are affected and which versions contain the fix?

What is the impact of successful exploitation?