A critical deserialization vulnerability in GLPI allows authenticated technician users to achieve remote code execution on affected systems.

This vulnerability involves the deserialization of untrusted data (CWE-502) triggered through unsafe PHP instantiation. An attacker must possess at least technician-level privileges to upload the malicious file and execute the payload.

The ability for an authenticated user to perform remote code execution represents a total compromise of the application server. Given the CVSS score of 8.0, this high-severity flaw could lead to complete loss of confidentiality, integrity, and availability of sensitive IT asset management data, potentially serving as a pivot point for lateral movement within the corporate network.

Immediate Action: Upgrade all GLPI instances to version 11.0.5 or later, as this release includes the necessary patches to address the unsafe deserialization flaw.

Proactive Monitoring: Inspect system and application logs for unusual file upload activities or unexpected PHP execution patterns originating from technician-level accounts.

Compensating Controls: Implement strict file upload policies and restrict the types of files that can be uploaded to the server, while utilizing a Web Application Firewall to block suspicious serialized payloads.

Public Exploit Available: No (exploit_available: false)

Organizations currently running GLPI versions 11.0.0 through 11.0.4 must prioritize the transition to version 11.0.5. Given the potential for full system compromise, administrators should treat this update with high urgency and audit existing technician accounts for any signs of prior unauthorized activity.