What’s Vulnerable › Vulnerabilities

CVE-2021-43778: Path traversal in GLPI barcode plugin

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 52.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-11-24 · updated 2026-06-17
• Weakness: CWE-22

Description

Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability. This issue was patched in version 2.6.1. As a workaround, delete the `front/send.php` file.

Affected products

• pluginsGLPI barcode: from 2.0 before 2.6.1 — fixed in 2.6.1

How to fix

Upgrade to a fixed version: pluginsGLPI barcode 2.6.1. Check the vendor advisory for mitigations.

References

• https://github.com/hansmach1ne/MyExploits/tree/main/Path%20Traversal%20in%20GLPI%20Barcode%20plugin
• https://github.com/pluginsGLPI/barcode/commit/428c3d9adfb446e8492b1c2b7affb3d34072ff46
• https://github.com/pluginsGLPI/barcode/releases/tag/2.6.1
• https://github.com/pluginsGLPI/barcode/security/advisories/GHSA-2pjh-h828-wcw9
• https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2021-43778
• https://github.com/hansmach1ne/MyExploits/tree/main/Path%20Traversal%20in%20GLPI%20Barcode%20plugin
• https://github.com/pluginsGLPI/barcode/commit/428c3d9adfb446e8492b1c2b7affb3d34072ff46
• https://github.com/pluginsGLPI/barcode/releases/tag/2.6.1
• https://github.com/pluginsGLPI/barcode/security/advisories/GHSA-2pjh-h828-wcw9

Get alerted when CVE-2021-43778 or the next vulnerability affects your stack