VULNERABILITY INTELLIGENCE

CVE-2023-42802

CVSS score10 CRITICAL

EPSS probability1.06%

CISA KEVNot currently listed

Published2023-11-02

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Description

GLPI is a free asset and IT management software package. Starting in version 10.0.7 and prior to version 10.0.10, an unverified object instantiation allows one to upload malicious PHP files to unwanted directories. Depending on web server configuration and available system libraries, malicious PHP files can then be executed through a web server request. Version 10.0.10 fixes this issue. As a workaround, remove write access on `/ajax` and `/front` files to the web server.

Weakness classification

CWE-20: Improper Input Validation
CWE-434: Unrestricted Upload of File with Dangerous Type

Primary references

security-advisories@github.com — Release Notes
security-advisories@github.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory