CVE-2026-22248: 
GLPI vulnerability analysis and mitigation

CVE-2026-22248 is a Remote Code Execution (RCE) vulnerability in GLPI, an open-source IT asset and service management platform. An authenticated technician user can upload a malicious file and trigger its execution through an unsafe PHP instantiation, classified under CWE-502 (Deserialization of Untrusted Data). The vulnerability affects GLPI versions 11.0.0 through 11.0.4 and was disclosed on March 11, 2026, with a fix released in version 11.0.5 (GitHub Advisory). The NVD assigns a CVSS v3.1 base score of 8.8 (High), while the GitHub advisory scores it at 8.0 (High) (GitHub Advisory).

The root cause is improper deserialization of untrusted data (CWE-502), specifically through an unsafe PHP object instantiation triggered after a malicious file upload. An authenticated technician-level user can craft and upload a specially designed file that, when processed by the GLPI application, causes the PHP runtime to instantiate objects in an unsafe manner, leading to arbitrary code execution on the server. The attack vector is network-based, requires low-to-high privileges (depending on scoring source), and no user interaction beyond the attacker's own actions. The vulnerability was reported by researcher r1beirin and disclosed via GitHub Security Advisories (GitHub Advisory).

Successful exploitation grants an attacker arbitrary code execution on the GLPI server, resulting in high impact to confidentiality, integrity, and availability. An attacker could exfiltrate sensitive IT asset data, credentials, and ITIL service desk records; modify or destroy system data; and disrupt service availability entirely. The scope of impact may extend beyond the GLPI application itself, potentially enabling lateral movement within the hosting environment (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.082%, indicating a currently low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the technician level, which somewhat limits the attack surface compared to unauthenticated vulnerabilities.

1. Gain Technician Access: Obtain or compromise a GLPI technician-level account through credential theft, phishing, or brute force against a GLPI instance running versions 11.0.0–11.0.4.
2. Craft Malicious File: Prepare a specially crafted file (e.g., a PHP-serialized payload or a file designed to trigger unsafe PHP object instantiation upon processing) that exploits the deserialization flaw.
3. Upload Malicious File: Use the authenticated session to upload the crafted file through GLPI's file upload functionality available to technician users.
4. Trigger Execution: Interact with the application in a way that causes GLPI to process the uploaded file via the vulnerable PHP instantiation code path, triggering deserialization of the malicious payload.
5. Achieve Code Execution: The deserialized payload executes arbitrary PHP code on the server under the web server's process context, enabling reverse shell establishment, data exfiltration, or further system compromise (GitHub Advisory).

• Network: Unusual outbound connections from the GLPI web server to external IPs following file upload activity; unexpected reverse shell connections originating from the web server process.
• File System: Presence of unexpected PHP files or scripts in GLPI upload directories (e.g., files/, _uploads/); newly created web shells or executable scripts in the GLPI document root.
• Logs: GLPI application logs showing file uploads by technician accounts followed by anomalous HTTP requests that trigger processing of those files; PHP error logs referencing unexpected class instantiation or deserialization errors.
• Process: Unusual child processes spawned by the web server (e.g., Apache/Nginx/PHP-FPM) such as bash, sh, curl, wget, or python; unexpected cron jobs or scheduled tasks created under the web server user account.

The primary remediation is to upgrade GLPI to version 11.0.5 or later, which contains the fix for this vulnerability (GitHub Advisory). Organizations unable to patch immediately should restrict technician account access to only trusted personnel and limit file upload capabilities where possible. Additional hardening measures include implementing network segmentation to restrict GLPI access to trusted networks, monitoring file upload activity for anomalies, and reviewing logs for unauthorized access or code execution attempts (Feedly).

The vulnerability was discussed on the GLPI project forum and noted by security aggregators including VulDB, CVEFeed, and Tenable (Nessus plugin 302205) (Tenable). Social media mentions were observed on Mastodon and Bluesky, with community commentary focused on the need to patch promptly given GLPI's role in IT infrastructure management. No major vendor statements beyond the GitHub Security Advisory from the GLPI maintainer (cedric-anne) have been issued.