CVE-2026-47678: 
GLPI vulnerability analysis and mitigation

CVE-2026-47678 is a SQL injection vulnerability in GLPI (Gestionnaire Libre de Parc Informatique), a free IT asset management software package. Any authenticated user can submit crafted values to the dropdown values fetching endpoint (Dropdown::getDropdownValue) that are incorporated unsanitized into database queries, enabling SQL injection. Affected versions span from 9.4.0 through 10.0.25 and 11.0.0 through 11.0.7. The vulnerability was published on July 27, 2026, and patched in versions 10.0.26 and 11.0.8. It carries a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The vulnerable code path in src/Dropdown.php within the getDropdownValue() function previously allowed the condition POST parameter to be passed directly as an array into the database query builder without adequate validation — bypassing the intended session-key lookup mechanism. The fix, applied in commits 7cffc8f (10.x branch) and c261f2d (11.x branch), enforces that the condition parameter must be a session key (string hash) that maps to a server-side stored condition array, and if the key is not found in $_SESSION['glpicondition'], the condition is silently ignored rather than passed through. This prevents user-controlled input from reaching the SQL query construction layer (GitHub Advisory, Fix Commit 10.x, Fix Commit 11.x).

Successful exploitation allows any authenticated GLPI user — regardless of their privilege level — to execute arbitrary SQL queries against the underlying database. This can result in unauthorized reading of sensitive data (user credentials, asset inventory, configuration data), modification or deletion of database records, and potential disruption of GLPI service availability. The scope is limited to the GLPI database itself, with no direct subsequent system impact, but credential exposure could enable lateral movement or privilege escalation within the broader IT environment (GitHub Advisory, Feedly).

As of the time of publication, there is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires valid authentication credentials, which limits the attack surface compared to unauthenticated vulnerabilities, but any low-privileged account is sufficient (GitHub Advisory).

1. Obtain valid credentials: Acquire any authenticated GLPI account — even a low-privileged user account suffices. This could be achieved through phishing, credential stuffing, or use of a self-registered account if open registration is enabled.
2. Authenticate to GLPI: Log in to the target GLPI instance and obtain a valid session cookie.
3. Identify the vulnerable endpoint: Target the dropdown values fetching endpoint, typically accessible via a POST request to the GLPI AJAX handler (e.g., /ajax/getDropdownValue.php or equivalent).
4. Craft a malicious condition parameter: In vulnerable versions, the condition POST parameter accepts an array that is passed directly into the SQL query builder. Craft a payload that injects SQL syntax into the WHERE clause, for example by supplying a raw SQL fragment as the condition value.
5. Submit the request: Send the crafted POST request with the malicious condition parameter to the endpoint while authenticated.
6. Extract data: Observe the JSON response from the dropdown endpoint, which may reflect query results, or use blind SQL injection techniques (time-based or boolean-based) to enumerate database contents including user tables, credentials, and configuration data (GitHub Advisory, Fix Commit 10.x).

• Network: Unusual or repeated POST requests to GLPI dropdown AJAX endpoints (e.g., /ajax/getDropdownValue.php) containing oversized or syntactically anomalous condition parameters; requests with SQL keywords (SELECT, UNION, SLEEP, BENCHMARK, OR 1=1) in POST body parameters.
• Logs: Web server access logs showing high-frequency requests to dropdown endpoints from a single authenticated session; application error logs showing SQL syntax errors or unexpected query failures originating from the Dropdown::getDropdownValue function.
• Database: Unexpected or anomalous queries in the database query log involving the GLPI tables with injected SQL fragments; queries returning unusually large result sets or executing time-delay functions (SLEEP(), BENCHMARK()).
• Process/Application: GLPI PHP error logs recording exceptions or warnings related to database query construction in src/Dropdown.php (GitHub Advisory).

Upgrade GLPI to version 10.0.26 (for the 10.x branch) or 11.0.8 (for the 11.x branch), both released on June 24, 2026, which contain the fix (GLPI Release 10.0.26, GLPI Release 11.0.8). As interim mitigations, restrict GLPI access to trusted and necessary users only, enforce strong authentication, and monitor database query logs for suspicious SQL patterns. Network segmentation to limit direct database access from the application server can reduce the blast radius of a successful exploit (Feedly).

The GLPI project team classified this as a High severity security issue and included it in a coordinated security release alongside multiple other CVEs, recommending immediate upgrade (GLPI Release 10.0.26, GLPI Release 11.0.8). The vulnerability was credited to researcher "camberty" in the GitHub Security Advisory (GitHub Advisory). Community discussion was noted on the GLPI project forum, and the release attracted positive reactions from the user community given the breadth of security fixes included.