CVE-2018-7562

A remote code execution issue was discovered in GLPI through 9.2.1. There is a race condition that allows temporary access to an uploaded executable file that will be disallowed. The application allows an authenticated user to upload a file when he/she creates a new ticket via front/fileupload.php. This feature is protected using different types of security features like the check on the file's extension. However, the application uploads and creates a file, though this file is not allowed, and then deletes the file in the uploadFiles method in inc/glpiuploaderhandler.class.php.

• CWE-362
• CWE-434

• https://github.com/glpi-project/glpi/pull/3650Issue Tracking, Third Party Advisory
• https://membership.backbox.org/glpi-9-2-1-multiple-vulnerabilities/Permissions Required
• https://github.com/glpi-project/glpi/pull/3650Issue Tracking, Third Party Advisory
• https://membership.backbox.org/glpi-9-2-1-multiple-vulnerabilities/Permissions Required

Published

Mar 12, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-7554There is an invalid free in ReadImage in input-bmp.ci that l…
• CVE-2018-7556LimeSurvey 2.6.x before 2.6.7, 2.7x.x before 2.73.1, and 3.x…
• CVE-2018-7557The decode_init function in libavcodec/utvideodec.c in FFmpe…6.5
• CVE-2018-7559An issue was discovered in OPC UA .NET Standard Stack and Sa…
• CVE-2018-7560index.js in the Anton Myshenin aws-lambda-multipart-parser N…7.5
• CVE-2018-7561Stack-based Buffer Overflow in httpd on Tenda AC9 devices V1…
• CVE-2018-7563An issue was discovered in GLPI through 9.2.1. The applicati…
• CVE-2018-7564Stored XSS exists on Polycom QDX 6000 devices.
• CVE-2018-7565CSRF exists on Polycom QDX 6000 devices.
• CVE-2018-7566The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ…
• CVE-2018-7567In the Admin Package Manager in Open Ticket Request System (…
• CVE-2018-7568The parse_die function in dwarf1.c in the Binary File Descri…