Peter Stiehl

**Name of the Vulnerable Software and Affected Versions** GLPI versions prior to 0.85.3 **Description** The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as an attachment to a new ticket and then accessing it directly. This is achieved by adding the file to files/ tmp/ and then making a direct request to the file. **Recommendations** For versions prior to 0.85.3, update to version 0.85.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the files/ tmp/ directory to prevent direct requests to uploaded files. Additionally, restrict the types of files that can be uploaded as attachments to prevent executable files from being added.

**Name of the Vulnerable Software and Affected Versions** GLPI versions prior to 0.85.3 **Description** The issue allows remote authenticated users to create super-admin accounts. This is achieved by leveraging permissions to create a user and the ` profiles id` parameter to the "front/user.form.php" endpoint. **Recommendations** For versions prior to 0.85.3, update to version 0.85.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the "front/user.form.php" endpoint and limiting the ability to create new users until the update is applied.