GLPI versions >= 0.78 and < 10.0.25, and >= 11.0.0 and < 11.0.7 contain a missing authorization vulnerability (CWE-862) that permits a technician to delete arbitrary files on the filesystem, contingent on the webserver's write permissions. This vulnerability arises from insufficient authorization checks allowing privileged users to perform unauthorized file deletions. The issue is resolved by upgrading to GLPI version 10.0.25 or 11.0.7.

An attacker with technician-level privileges can delete arbitrary files on the server filesystem if the webserver process has write access to those files. This could lead to denial of service or disruption of the GLPI service or other applications depending on the deleted files. The vulnerability requires the attacker to have some level of privilege (technician) and the webserver to have write permissions on target files.

Upgrade GLPI to version 10.0.25 or 11.0.7 or later, as these versions include a patch that fixes this missing authorization vulnerability. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor advisory embedded in the description.