Back to Database
Status published
Critical
CVE-2021-43778
Path traversal in GLPI barcode plugin
Vulnerability Description
Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability. This issue was patched in version 2.6.1. As a workaround, delete the `front/send.php` file.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-43778
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/pluginsGLPI/barcode/security/advisories/GHSA-2pjh-h828-wcw9
- https://github.com/pluginsGLPI/barcode/commit/428c3d9adfb446e8492b1c2b7affb3d34072ff46
- https://github.com/hansmach1ne/MyExploits/tree/main/Path%20Traversal%20in%20GLPI%20Barcode%20plugin
- https://github.com/pluginsGLPI/barcode/releases/tag/2.6.1
More from pluginsGLPI
View All →CVE-2025-65035
GLPI Database Inventory Plugin Vulnerable to Stored Object Injection
Medium
6.4
CVE-2025-53360
pluginsGLPI's Database Inventory Plugin allows any authenticated user to send agent requests
Medium
4.3
CVE-2025-27153
Escalade GLPI Plugin Vulnerable to Improper Access Control
Medium
6.5
CVE-2024-53850
The Addressing GLPI plugin allows data enumeration through uncontrolled object instantiation
High
8.2
CVE-2024-45600
Fields GLPI plugin has an Authenticated SQL Injection
High
7.7
Affected Vendor
pluginsGLPI
View all reports →Affected Software
barcode
Vulnerable Versions:
>= 2.0.0, < 2.6.1
Timeline
Official Publish:
November 24th, 2021
Last Modified:
September 8th, 2025
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N