An authenticated path traversal vulnerability in GLPI, rated at 8.5 (High), allows unauthorized file deletion and poses a significant risk to system integrity.

This vulnerability is a path traversal (CWE-22) located in the profile-picture update function. Any authenticated user can exploit insufficient path validation to trigger the deletion of arbitrary files hosted by the server.

The ability for a standard authenticated user to delete arbitrary files on the server can lead to full system instability, service disruption, or the removal of critical configuration files. With a CVSS score of 8.5, this high-severity flaw represents a significant risk to operational availability and data integrity. Unauthorized file deletion could also be leveraged as a component in more complex attack chains, potentially facilitating further system compromise.

Immediate Action: Update GLPI to version 10.0.26 or 11.0.8 immediately to resolve the path validation flaw.

Proactive Monitoring: Review web server and application logs for suspicious file system requests or errors associated with profile management endpoints.

Compensating Controls: Implement strict file system permissions to limit the web server process user to the minimum necessary directory access.

Public Exploit Available: No

Given the severity of this vulnerability and the potential for malicious actors to cause widespread system failure, administrators should prioritize patching. Apply the vendor-supplied updates to version 10.0.26 or 11.0.8 as soon as possible to neutralize this risk.