A flaw in GLPI’s profile‑picture update flow allows any logged‑in user to craft a request that deletes an arbitrary file on the server. The vulnerability arises from insufficient path validation, meaning the application does not restrict the target file to the user’s own picture directory. The deletion can affect any writable file on the web server, potentially removing critical configuration files, application assets, or user data, which compromises integrity and availability.

GLPI from the GLPI Project is affected in all releases from 10.0.0 up to but not including 10.0.26, and from 11.0.0 up to but not including 11.0.8. These versions can be identified by the GLPI Project’s product name. Updated releases 10.0.26 and 11.0.8 contain the fix and should be used.

The vulnerability has a CVSS score of 8.5, indicating high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. An attacker only needs to be authenticated to a GLPI instance, so the attack vector is likely authenticated remote. Because any writable file can be targeted, the potential impact is significant if used against system or application files.