GLPI versions 11.0.0 through 11.0.8 allow a form administrator to import a file with a crafted illustration or scene identifier that performs a directory traversal outside the intended custom‑asset directory. This flaw permits writing arbitrary files to server locations such as an executable directory, giving a malicious actor the ability to run a script remotely. The weakness is a classic path traversal vulnerability (CWE‑22).

The affected product is GLPI from the glpi-project. All installations of GLPI version 11.0.0 up to and including 11.0.8 are vulnerable. Versions 11.0.8 and newer include the fix.

The CVSS base score of 9.4 classifies this issue as a high‑impact remote code execution vector. The Enterprise Package Support Score (EPSS) is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Because the flaw is triggered through the form import feature, an attacker only needs to gain access to the form import interface, which is typically an administrative function, and supply a malicious file path. Once executed, the attacker gains the same privileges as the web server process, allowing full control of the affected system.