↓ Ir para o conteúdo principal
EF-TECH
EF-TECH
  1. Cloud Computing Solutions/
  2. Blog/

GLPI 11.0.9 and 12.0.0-rc2: Security Release and a Preview of GLPI 12

·639 palavras·3 minutos
EF-TECH
Autor
EF-TECH
Transforme a performance e a segurança do seu ambiente com nossas soluções!
Tabela de conteúdos

On September 17, 2026, EF-TECH published two new releases of the eftechcombr/glpi project, which packages GLPI as Docker images (PHP-FPM + Nginx) and a Helm chart for Kubernetes: the stable 11.0.9 release — a security release fixing 10 high-severity vulnerabilities, with immediate upgrade recommended — and the 12.0.0-rc2 pre-release, which previews the features of GLPI’s upcoming major version.

GLPI 11.0.9 and 12.0.0-rc2

GLPI 11.0.9: Security Release — Upgrade Now
#

GLPI 11.0.9 was released upstream by the glpi-project on September 16, 2026, and is classified as a security release. It fixes 10 high-severity vulnerabilities:

  • XSS via form illustration import;
  • Stored XSS in ticket actors;
  • MFA bypass by another GLPI user;
  • Stored XSS via asset name;
  • Stored XSS in network equipment models;
  • Upload of a malicious page on the web server;
  • Unauthenticated SQL injection in the planning feature;
  • Unexpected X509 authentication success with an unverified certificate;
  • Race condition in the marketplace, allowing malicious plugin installation;
  • Arbitrary file deletion during document creation.

Two medium-severity issues were also fixed:

  • Unexpected access to followups, tasks, and solutions generated from templates;
  • Unauthorized visibility expansion of knowbase items, reminders, and RSS feeds.

Given the nature of these fixes — including unauthenticated SQL injection and MFA bypass — we recommend upgrading all production environments to 11.0.9 as soon as possible. The EF-TECH release ships GLPI 11.0.9 together with Helm chart glpi-2.11.5.

Helm Chart: What’s New in This Cycle
#

The 11.0.9 cycle consolidated a series of structural improvements to the Helm chart (PRs #170–#204), also inherited by the 12.x line:

  • Valkey subchart (helmforge/valkey): the inline Redis was replaced by Valkey, with a new externalCache configuration to point GLPI at externally managed cache clusters;
  • MariaDB subchart (helmforge/mariadb): the inline MariaDB was replaced by a dedicated subchart, and the chart now reads the MARIADB_PASSWORD directly from the Secret generated by the MariaDB subchart itself;
  • High availability: optional PodDisruptionBudget and HorizontalPodAutoscaler for php-fpm and nginx — contributed by @danielqb, the project’s first external contributor;
  • Hardening: priorityClassName support, optional readOnlyRootFilesystem hardening, and Bitnami-style resourcesPreset resource tiers;
  • Secrets: existingSecret support for externalDatabase with fail-fast validation on misconfiguration;
  • Operational reliability: the maintenance CronJob is now gated on actual GLPI and database readiness; unused volume mounts and the DB secret were removed from the Nginx container;
  • Backup: new optional files-backup CronJob to S3-compatible storage;
  • Organization: the kubernetes/glpi manifests were moved to helm/, and the chart is now published on Artifact Hub (validation errors fixed).

The project’s 12.0.0-rc2 release also fixes hadolint DL3064/DL3066 warnings in the PHP Dockerfile.

GLPI 12.0.0-rc2: What’s Coming
#

GLPI 12.0.0-rc2 is the second Release Candidate of GLPI’s upcoming major version, also released upstream on September 16, 2026. Highlights of GLPI 12 include:

  • Knowledge base rework;
  • Sessions manager;
  • Sudo mode, for controlled privilege elevation during a session;
  • OLA rework (Operational Level Agreements);
  • Hardened security (SQL, CSRF, and more);
  • Accessibility advancements.

Warning: as a pre-release, 12.0.0-rc2 must not be used in production. Use it for staging, migration testing, and validating new features — for production environments, the recommended version is 11.0.9. The EF-TECH release ships GLPI 12.0.0-rc2 together with Helm chart glpi-2.12.1.

How to Upgrade or Try It
#

To upgrade using the Helm chart:

# Add or update the EF-TECH Helm repository
helm repo add eftech https://eftechcombr.github.io/glpi/charts
helm repo update

# Install or upgrade to the stable release (GLPI 11.0.9)
helm upgrade --install glpi eftech/glpi \
  --namespace glpi \
  --create-namespace \
  --version 2.11.5

For standalone Docker usage:

# Stable (recommended for production)
docker pull ghcr.io/eftechcombr/glpi:11.0.9

# Pre-release (staging/testing only)
docker pull ghcr.io/eftechcombr/glpi:12.0.0-rc2

Links and references:

At EF-TECH, we specialize in Kubernetes, cloud computing, and infrastructure automation. We design, deploy, and operate high-performance GLPI environments with security, observability, and scalability built in. Contact us to learn how we can help your team. For more articles like this, visit our blog.