CVE-2026-42320 MEDIUM

CVE-2026-42320: GLPI vulnerable to arbitrary file access

Vendor Glpi-Project
Product glpi
Weakness CWE-862 · Missing authorization
Published June 3, 2026
Last update June 3, 2026
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 10.0.25 and 11.0.7, a technician can read arbitrary files inside the GLPI_DOC_DIR. Upgrade to 10.0.25 or 11.0.7 to receive a patch.

Key dates

02Disclosure timeline

June 3, 2026 CVE published
June 3, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-13715 zStore Manager Basic <= 3.311 - Missing Authorization to Authenticated (Subscriber+) Cache Clearing CVE-2023-7293 Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'check_mollie_account_details' CVE-2024-2508 WP Mobile Menu <= 2.8.4.4 - Missing Authorization to _mobmenu_icon Post Meta Modification CVE-2024-43159 WordPress Masteriyo LMS plugin <= 1.11.6 - Broken Access Control vulnerability CVE-2023-30490 WordPress Easing Slider plugin <= 3.0.8 - Plugin Settings Reset Vulnerability