GLPI: patch branch 10 or 11 without confusing updates with migration
CERT-FR lists GLPI before 10.0.28 and 11.0.x before 11.0.10. Check your installed branch and who is responsible for applying its fix.
Getting started
Generated image · SecuFocus
At a glance
Key points
Do you manage GLPI for help-desk requests or IT assets? CERT-FR’s 3 November advisory distinguishes two branches: versions before 10.0.28, and 11.0.x versions before 11.0.10. Start by identifying the installed branch. The notice does not require every security update to become a migration to GLPI 11.
Two version boundaries, not one release for every installation
CERTFR-2026-AVI-1444 links to three GLPI advisories dated 2 November. It lists privilege escalation, cross-site scripting (XSS) and security-policy bypass risks. Its affected-systems list gives “versions before 10.0.28” and “11.0.x versions before 11.0.10”.
Those lines are not interchangeable. If your service remains on branch 10, have its planned fix confirmed rather than imposing an emergency major-version migration. For GLPI 11.0.x, check that branch’s own boundary and the package actually deployed.
| Branch being checked | CERT-FR version reference |
|---|---|
| GLPI before 10.0.28 | 10.0.28 |
| GLPI 11.0.x before 11.0.10 | 11.0.10 |
Confirm the service update, not just an agent update
Ask the operator to confirm the GLPI version, update method and recoverable data backup before intervention. Our practical recommendations are to check login, request creation and important integrations afterwards. Updating an inventory agent or an extension does not establish the server application’s version.
If GLPI is delivered as a managed service, ask the provider to confirm the fix on your instance. The availability of a release on the project website does not prove that deployment.
The summary does not describe every attack condition
The notice we read does not detail the required roles, attack path or ongoing exploitation for each vulnerability. We therefore infer neither an unauthenticated attack nor a compromise of your instance. Vendor links are not a substitute for reading their contents; this note stays within the facts established by CERT-FR.
SecuFocus has not installed these releases or reproduced a vulnerability. Version verification and post-update checks need to take place on your own service.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.