GLPI 11.0.8 and 10.0.26 shipped on 24 June 2026 — the heaviest core security update since GLPI 11 was released. Five days later, on 29 June, the GLPI team published a second advisory that reached far fewer administrators: vulnerabilities in community plugins.
What the advisory covers
The advisory spans several plugins at once. The most serious issue is a remote code execution flaw in GenericObject, rated CVSS 8.9. Beyond that it lists SQL injection and cross-site scripting across multiple plugins, and access control failures in Escalade, Credit and Glpinventory. Datainjection, PDF and Tag are affected as well.
Instances running on GLPI Network Cloud Public and Private were patched automatically. Anyone self-hosting — which covers most public sector and industrial deployments in Slovakia — has to act on their own.
Three fixes with concrete numbers
- GenericObject — CVE-2026-52728, CVSS 8.9. An authenticated user with UPDATE rights can smuggle code into a generated PHP locale file through an object type name. It affects the branch compatible with GLPI 10: version 2.14.14 is vulnerable, 2.14.15 carries the fix. Technical details were published on 24 July 2026.
- Tag — CVE-2026-53987, CVSS 7.3. Stored XSS: a tag name is rendered into the Kanban badge without output escaping, so injected code runs for anyone opening the Kanban view of tickets, problems, changes or projects. Fixed in version 2.14.4 for GLPI 11.
- Datainjection — CVE-2026-11321, CVSS 7.1. Values from an imported CSV are concatenated straight into SQL queries without parameterisation. A user with import access can read database contents through timed queries.
Why plugins are a blind spot
A GLPI plugin is not an isolated component. It runs in the same PHP process, with the same database credentials and inside the same session as the core. RCE in a plugin is therefore just as severe as RCE in the core — the difference is that nothing warns you about it when you log in.
Then there is ordinary operational reality: a plugin gets installed for one project, the project ends, and the plugin stays installed and enabled for years. Plugin versions also differ between the 10.0 and 11.0 branches, so "we are on the latest version" does not necessarily mean you are on the patched one.
What to check
- Compare the list of installed plugins and their versions (Setup → Plugins) against current catalogue versions.
- Uninstall plugins nobody uses — do not just disable them. A disabled plugin still sits on disk.
- After updating, test the places where the plugin touches forms, notifications and workflows.
- Update GLPI Agent too. Version 1.18, released 23 June 2026, is essentially a security release and addresses 13 vulnerabilities including path traversal and command injection.
The compliance angle
Vulnerability management under Decree 227/2025 does not stop at the operating system and the application core. If a plugin is part of a production system, it is in scope — version records, patch deadlines and assigned ownership included. A plugin list with versions and last-update dates also happens to be one of the fastest pieces of evidence to produce during an audit.