CVE-2025-64516
published 2026-01-15CVE-2025-64516: GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item…
PriorityP348high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.28%
19.4th percentile
GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset, ...). If the public FAQ is enabled, this unauthorized access can be performed by an anonymous user. This vulnerability is fixed in 10.0.21 and 11.0.3.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| glpi-project | glpi | — | — |
| glpi-project | glpi | — | — |
| glpi-project | glpi | >= 10.0.0 < 10.0.21 | 10.0.21 |
| glpi-project | glpi | >= 11.0.0 < 11.0.3 | 11.0.3 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
https://github.com/glpi-project/glpi/commit/51412a89d3174cfe22967b051d527febdbceab3chttps://github.com/glpi-project/glpi/commit/ee7ee28e0645198311c0a9e0c4e4b712b8788e27https://github.com/glpi-project/glpi/releases/tag/10.0.21https://github.com/glpi-project/glpi/releases/tag/11.0.3https://github.com/glpi-project/glpi/security/advisories/GHSA-487h-7mxm-7r46
2026-01-15
Published