glpi-project/glpi 11.0.9

on GitHub

This is a security release, upgrading is recommended

You will find below the list of security issues fixed in this bugfixes version:

• [SECURITY - High] XSS via form illustration import
• [SECURITY - High] Stored XSS in ticket actors
• [SECURITY - High] MFA bypass by another GLPI user
• [SECURITY - High] Stored XSS via asset name
• [SECURITY - High] Stored XSS in network equipement models
• [SECURITY - High] Upload of malicious page on the web-server
• [SECURITY - High] Unauthenticated SQL injection in planning feature
• [SECURITY - High] Unexpected X509 authentication success with unverified certificated
• [SECURITY - High] Race condition in marketplace allowing malicious plugin installation
• [SECURITY - High] Arbitrary files deletion during documents creation
• [SECURITY - Medium] Unexpected access to followups/tasks/solutions generated from templates
• [SECURITY - Medium] Unauthorized visibility expansion of knowbase items, reminders and RSS feed

The full changelog is available for more details.

We would like to thank all people who contributed to this new version and all those who contributes regularly to the GLPI project!

Regards.