A critical path traversal vulnerability in GLPI versions 11.0.0 through 11.0.7 permits authenticated administrators to achieve remote code execution by uploading malicious files to executable directories.

This vulnerability is a path traversal flaw (CWE-22) occurring within the Form import functionality. A user with administrative privileges can supply a crafted identifier to overwrite files in unintended locations on the server, facilitating the remote invocation of malicious scripts.

The ability to execute arbitrary code on the server represents a total compromise of the application and its underlying host. Given the CVSS score of 9.4, this vulnerability poses a severe threat to data integrity, confidentiality, and system availability. Organizations relying on GLPI for IT asset management may face significant operational disruption and data exfiltration risks if this flaw is exploited by a malicious actor with administrative access.

Immediate Action: Update the GLPI installation to version 11.0.8 or later immediately to apply the patch provided by the vendor.

Proactive Monitoring: Review web server access and error logs for suspicious file upload activity or requests containing directory traversal sequences like dot-dot-slash patterns.

Compensating Controls: Ensure that the web server process runs with the least privilege necessary, and restrict the write permissions of the application user to prevent files from being written into executable directories.

Public Exploit Available: Unknown

Due to the critical nature of this vulnerability and the potential for remote code execution, all administrators should prioritize the upgrade to version 11.0.8. Even though the exploit requires administrative access, the risk of credential compromise or insider threats necessitates immediate patching to secure the IT management infrastructure.