CVE-2020-11060: Remote Code Execution in GLPI

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-05-12 · updated 2026-06-17
Weakness: CWE-74

Description

In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only conceivable by an account having Maintenance privileges and the right to add WIFI networks. This is fixed in version 9.4.6.

Affected products

glpi-project glpi: before 9.4.6 — fixed in 9.4.6

How to fix

Upgrade to a fixed version: glpi-project glpi 9.4.6. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/163119/GLPI-9.4.5-Remote-Code-Execution.html
https://github.com/glpi-project/glpi/commit/ad748d59c94da177a3ed25111c453902396f320c
https://github.com/glpi-project/glpi/security/advisories/GHSA-cvvq-3fww-5v6f
http://packetstormsecurity.com/files/163119/GLPI-9.4.5-Remote-Code-Execution.html
https://github.com/glpi-project/glpi/commit/ad748d59c94da177a3ed25111c453902396f320c
https://github.com/glpi-project/glpi/security/advisories/GHSA-cvvq-3fww-5v6f

Get alerted when CVE-2020-11060 or the next vulnerability affects your stack