CVE-2020-15175

CVE-2020-15175 is a critical vulnerability affecting GLPI versions prior to 9.5.2, where a maliciously crafted request to the pluginimage.send.php endpoint can delete the .htaccess file, exposing sensitive data within the /files/ directory. This allows unauthorized access to information such as user sessions and logs, potentially enabling an attacker to compromise administrator accounts. With a CVSS score of 9.1 (Critical), the vulnerability is easily exploitable over the network with no user interaction required, leading to high confidentiality and integrity impacts. While no public exploit code or active exploitation has been observed, and community discussion is minimal, the potential for severe compromise necessitates immediate patching.