Unauthenticated File Deletion in GLPI
No sign of exploitation. No public exploitation artifact known so far.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
An unauthenticated attacker can delete the .htaccess file in GLPI's files directory, exposing sensitive data like user sessions and logs. This allows them to impersonate administrators and take over the system.
CVE-2020-15175 exploits improper input validation in the pluginimage.send.php endpoint, allowing unauthenticated users to manipulate parameters and delete the .htaccess access control file. This removes directory listing protections, exposing session tokens and sensitive logs that enable privilege escalation and full system compromise.