GLPI versions from 11.0.0 up to but not including 11.0.8 contain a path traversal vulnerability in the Form import functionality. Specifically, an administrator can supply a crafted illustration or scene identifier that escapes the designated custom-asset directory, enabling arbitrary file write to locations that may be executable on the server. This can lead to remote code execution by invoking the malicious script placed via this method. The vulnerability is tracked as CVE-2026-48482 with a CVSS 4.0 score of 9.4, indicating critical severity. The flaw is resolved in GLPI version 11.0.8.

Successful exploitation allows an attacker with administrator privileges on the Form import feature to write files outside the intended directory, including executable locations on the server. This can lead to remote code execution, compromising the server's integrity and potentially allowing full system control.

Upgrade GLPI to version 11.0.8 or later, where this vulnerability is fixed. No other mitigations are specified or required once the official fix is applied.