What did CERT-FR report?
Advisory CERTFR-2026-AVI-1389 references seven GLPI vulnerabilities. Reported risks include SQL injection, cross-site scripting (XSS), authentication security bypasses and plugin-related security weaknesses. Actual exposure depends on the version, permissions and configuration.
Which versions should administrators check?
The advisory cites GLPI 11.0.x before 11.0.9 and versions earlier than 10.0.27. These are patch thresholds for the reported issues, not necessarily the versions to deploy today.
As of October 28, 2026, GLPI 11.0.11 and 12 are available. GLPI 10 has reached end of support following the GLPI 12 release. Consult the official releases and migration requirements before upgrading.
A practical security checklist
- Inventory: record the GLPI version, plugins, integrations and enabled authentication methods.
- Back up: preserve the database, attachments, configuration and plugins; validate restoration.
- Test: check PHP and database requirements as well as plugin compatibility in staging.
- Patch: install a maintained release from the official GLPI repository and plan migrations away from GLPI 10.
- Harden: apply least privilege, enable MFA where available, remove unused plugins and limit unnecessary public exposure.
- Monitor: review application logs and unusual activity. Installing a fix does not rule out earlier compromise.
Preparing a GLPI 12 migration
Inventory integrations and plugins, review technical requirements, test a full restore and rehearse the migration in a separate environment. Validate logins, tickets and critical workflows before switching production over.
Key takeaway
Check versions, preserve backups, apply fixes and move to a supported branch. The seven reported security issues have patches, so the focus should be on reliable maintenance rather than alarm.
TechAtelier Software Watch can help identify deployed software and review updates. It does not replace vendor notices or incident response.
Sources
Published 28 October 2026.