Critical · published November 24, 2021
CVSS calls it critical at 9.1. It sits in the 99.0th percentile for exploit probability.
🚨 A sneaky path traversal vulnerability in the Barcode plugin for GLPI could let attackers access sensitive files on your server! 🔥 Think of it like a delivery driver sneaking into a restricted area to grab anything they want, simply because the gate wasn’t locked properly. This flaw lets unauthorized users access files they shouldn’t—yikes! An attacker could exploit this vulnerability to read sensitive server files, potentially exposing confidential data or configurations. If left unchecked, this could lead to a serious breach, compromising your GLPI instance and putting your organization at risk.
Think of it like a delivery driver sneaking into a restricted area to grab anything they want, simply because the gate wasn’t locked properly. This flaw lets unauthorized users access files they shouldn’t—yikes! This path traversal vulnerability occurs in GLPI instances version 2.x prior to 2.6.1 with the Barcode plugin installed, allowing attackers to access files outside the intended directory structure by manipulating file paths.
An attacker could exploit this vulnerability to read sensitive server files, potentially exposing confidential data or configurations. If left unchecked, this could lead to a serious breach, compromising your GLPI instance and putting your organization at risk. Immediately update your GLPI instance to version 2.6.1 or later to patch this critical vulnerability. As a temporary workaround, you can delete the `front/send.php` file to mitigate the risk until you can upgrade. Don't wait on this—act now! You've got this! Follow these steps to secure your server and keep your GLPI instance safe. 🛡️