CVE-2022-34128: GLPI-Project Positions

Critical severity, CVSS 9.8. EPSS: 7.8% chance of exploitation in the next 30 days.

The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php.

Affected products

• GLPI-Project Positions: before 6.0.1 (fixed in 6.0.1)

Published 2023-04-16. Last modified 2026-06-17.