An authenticated user can exploit a path traversal flaw in the glpi-screenshot-plugin to leak sensitive system files or leverage PHP wrappers.

The plugin fails to properly validate user-supplied file paths within the /ajax/screenshot.php endpoint, which allows an authenticated user to perform arbitrary file reads using path traversal or PHP stream wrappers (CWE-73).

A successful exploit allows an authenticated attacker to read arbitrary files from the underlying server, potentially exposing configuration files, credentials, or sensitive application data. With a CVSS score of 7.7, this is a high-severity risk that could lead to full system compromise if the leaked information includes environment secrets or database credentials.

Immediate Action: Update the glpi-screenshot-plugin to version 2.0.2 or later to apply the necessary path validation fixes.

Proactive Monitoring: Review web server access logs for anomalous requests targeting the /ajax/screenshot.php endpoint, particularly those containing directory traversal sequences like "../" or PHP wrapper syntax.

Compensating Controls: Ensure the web application user has the least privilege necessary, specifically restricting its ability to access files outside the designated web root, and deploy a WAF to filter requests containing suspicious path traversal patterns.

Public Exploit Available: Unknown

Given the high-severity nature of arbitrary file disclosure, administrators should prioritize updating the glpi-screenshot-plugin to version 2.0.2 immediately. Restricting access to the GLPI administrative interface and applying the patch will effectively mitigate the risk of data exfiltration and potential downstream system compromise.