CVE-2026-47678 · Package
NO FIX YET · SEE WHAT TO DO
GLPI is an open-source asset and IT management application. Any logged-in user can send crafted values to its dropdown fetching endpoint, which are placed into a database query, letting an attacker read or change database data.
first public Jul 27, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any GLPI instance from 9.4.0 up to the fixed versions is exposed, as long as at least one user can log in to it. Because the flaw is in the dropdown endpoint that the web interface calls, any authenticated account, including low-privilege ones, can reach it. Instances that are not reachable by any user account are lower risk but should still be upgraded.
Not affected if default-config
Who cares glpi, php, self-hosted
version file of the GLPI install10.0.26 and 11.0.8 are affected11.0.8 for the 11.x line10.0.26 for the 10.x lineGLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown values fetching endpoint that are incorporated into a database query. This permits SQL injection through the dropdown endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.