TI-2021-19585 Aliases CVE-2021-43778

Path traversal in GLPI barcode plugin

HIGH 71CWE-22Published 2021-11-24 · Updated 2025-09-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability. This issue was patched in version 2.6.1. As a workaround, delete the `front/send.php` file.

Why it matters now

EPSS 0.52658 98th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed barcode (pluginsGLPI): 2.6.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pluginsGLPI	barcode	2.0.0 to before 2.6.1	2.6.1	Patch available	CNA

barcode VendorpluginsGLPI Affected 2.0.0 to before 2.6.1 Fixed in 2.6.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:glpi-project:barcode::::::::	2.0 to before 2.6.1	Vulnerable	glpi-project

cpe:2.3:a:glpi-project:barcode:*:*:*:*:*:*:*:* Versions 2.0 to before 2.6.1 Vulnerable ·glpi-project

Remediation

Fix · CNA barcode (pluginsGLPI) Fixed in 2.6.1

Timeline

2026-10-02 Threatist record created from CVE-2021-43778

References

Exploit 1

https://github.com/hansmach1ne/MyExploits/tree/main/Path%20Traversal%20in%20GLPI%20Barcode%20plugin

Patch 2

Advisory 1

https://github.com/pluginsGLPI/barcode/releases/tag/2.6.1

TI-2024-36046 The Addressing GLPI plugin allows data enumeration through uncontrolled object instantiation CVSS 3.1HIGH 8.2
TI-2026-38943 Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering CVSS 4.0HIGH 7.3
TI-2025-20010 Escalade GLPI Plugin Vulnerable to Improper Access Control CVSS 3.1MEDIUM 6.5
TI-2026-09772 GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import CVSS 4.0HIGH 7.1
TI-2024-30621 Fields GLPI plugin has an Authenticated SQL Injection CVSS 3.1HIGH 7.7
TI-2025-40221 GLPI Database Inventory Plugin Vulnerable to Stored Object Injection CVSS 3.1MEDIUM 6.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences