15. 10. 2026 Cecilia Marchi Bug Fixes, NetEye

NetEye 4 – Security Advisory (GLPI)

Important: GLPI security update

Type/Severity

NetEye Product Security has rated this update as having a medium security impact.

Topic

An update for the glpi packages is now available for NetEye 4.

Security Fix for NetEye 4.50

  • glpi-11.0.11_neteye1.25.5-1
  • glpi-autosetup-11.0.11_neteye1.25.5-1
  • glpi-configurator-11.0.11_neteye1.25.5-1
  • glpi-neteye-config-11.0.11_neteye1.25.5-1

Summary

The list of vulnerabilities, regarding to the bundled plugins, patched in this update is:

  • Fields
    • Missing authorization in configuration export — CVSS 2.3 (Low)
    • CSRF enabling destructive purges — CVSS 6.1 (Medium)
    • Missing authorization in an AJAX endpoint — CVSS 2.3 (Low)
    • Path traversal enabling arbitrary file deletion — CVSS 6.1 (Medium)
    • Reflected cross-site scripting (XSS) — CVSS 2.3 (Low)
  • OAuth SSO
    • Mass assignment and path traversal enabling arbitrary file deletion — CVSS 5.9 (Medium)
  • Data Injection
    • Error-CSV filename handling enabling file overwrite and deletion — CVSS 2.3 (Low)
  • CloudInventory
    • Stored cross-site scripting (XSS) — CVSS 3.6 (Low)
    • Debug-log path traversal — CVSS 2.3 (Low)

For details on how to apply this update, which includes the changes described in this advisory, refer to the NetEye Update Section in the User Guide.

Affected Products

All NetEye >=4.50 versions

Cecilia Marchi

Cecilia Marchi

Author

Cecilia Marchi

Leave a Reply

Your email address will not be published. Required fields are marked *

Archive