{"id":"CVE-2020-11060","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-11060","generatedAt":"2026-11-05T02:08:53.735Z","title":"In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality.","description":"In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only conceivable by an account having Maintenance privileges and the right to add WIFI networks. This is fixed in version 9.4.6.","published":"2020-05-12T20:15:12.000Z","lastModified":"2026-06-17T02:48:58.000Z","status":"Modified","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-74","CWE-352"],"affected":["glpi-project/glpi"],"epss":{"score":0.10661,"percentile":0.95809,"date":"2026-11-03","history":[]},"kev":{"listed":false},"exploits":{"count":2,"verified":false,"firstPublished":"2021-06-14","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":51726,"kind":"exploit","title":"GLPI GZIP(Py3) 9.4.5 - RCE","url":"https://www.exploit-db.com/exploits/51726","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/51726.py","file":"exploits/php/webapps/51726.py","published":"2023-10-09","added":"2023-10-09","updated":"2023-10-09","author":"Brian Peters","type":"webapps","platform":"php","port":null,"verified":false,"codes":["CVE-2020-11060"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null},{"edbId":49992,"kind":"exploit","title":"GLPI 9.4.5 - Remote Code Execution (RCE)","url":"https://www.exploit-db.com/exploits/49992","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/49992.py","file":"exploits/php/webapps/49992.py","published":"2021-06-14","added":"2021-06-14","updated":"2021-06-14","author":"Brian Peters","type":"webapps","platform":"php","port":null,"verified":false,"codes":["CVE-2020-11060"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 10.7%, higher than 96% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://packetstormsecurity.com/files/163119/GLPI-9.4.5-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"],"source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/commit/ad748d59c94da177a3ed25111c453902396f320c","tags":["Patch","Third Party Advisory"],"source":"security-advisories@github.com"},{"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-cvvq-3fww-5v6f","tags":["Patch","Third Party Advisory"],"source":"security-advisories@github.com"},{"url":"http://packetstormsecurity.com/files/163119/GLPI-9.4.5-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/glpi-project/glpi/commit/ad748d59c94da177a3ed25111c453902396f320c","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-cvvq-3fww-5v6f","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-11060","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}