Glpi-Project Glpi vulnerabilities

CVE-2023-41322 [HIGH] CWE-269 CVE-2023-41322: GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software p GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A user with write access to another user can make requests to change the latter's password and then take control of their account. Users are advised to upgrade to

CVE-2019-14666 [HIGH] CWE-200 CVE-2019-14666: GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletio GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any user. This vulnerability can be exploited to take control o

CVE-2024-47758 [HIGH] CWE-284 CVE-2024-47758: GLPI is a free asset and IT management software package. Starting in version 9.3.0 and prior to vers GLPI is a free asset and IT management software package. Starting in version 9.3.0 and prior to version 10.0.17, an authenticated user can use the API to take control of any user that have the same or a lower level of privileges. Version 10.0.17 contains a patch for this issue.

CVE-2026-29047 [HIGH] CWE-89 CVE-2026-29047: GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, a GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, an authenticated user can perform a SQL injection via the logs export feature. This vulnerability is fixed in 10.0.24 and 11.0.6.

CVE-2026-22248 [HIGH] CWE-502 CVE-2026-22248: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk feat GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. From 11.0.0 to before 11.0.5, an authenticated technician user can upload a malicious file and trigger its execution through an unsafe PHP instantiation. This vulnerability is fixed in 11.0.5.

CVE-2015-7684 [CRITICAL] CVE-2015-7684: Unrestricted file upload in GLPI before 0.85.3 allows remote authenticated users to execute arbitrar Unrestricted file upload in GLPI before 0.85.3 allows remote authenticated users to execute arbitrary code by adding a file with an executable extension as an attachment to a new ticket, then accessing it via a direct request to the file in files/_tmp/.

CVE-2023-41324 [HIGH] CWE-269 CVE-2023-41324: GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software p GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An API user that have read access on users resource can steal accounts of other users. Users are advised to upgrade to version 10.0.10. There are no known workaro

CVE-2024-47760 [HIGH] CWE-284 CVE-2024-47760: GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to vers GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.17, a technician with an access to the API can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue.

CVE-2023-42462 [CRITICAL] CWE-22 CVE-2023-42462: GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software p GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The document upload process can be diverted to delete some files. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vuln

CVE-2023-28634 [HIGH] CWE-285 CVE-2023-28634: GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versi GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profile could see and generate a Personal token for a Super-Admin. Using such token it is possible to negotiate a GLPI session and hijack the Super-Admin account, resulting in a Privilege Escalation.

CVE-2026-47679 [HIGH] CWE-22 CVE-2026-47679: GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any l GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions 11.0.8 and 10.0.26.

CVE-2025-21619 [CRITICAL] CWE-89 CVE-2025-21619: GLPI is a free asset and IT management software package. An administrator user can perfom a SQL inje GLPI is a free asset and IT management software package. An administrator user can perfom a SQL injection through the rules configuration forms. This vulnerability is fixed in 10.0.18.

CVE-2026-48482 [CRITICAL] CWE-22 CVE-2026-48482: GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administra GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location, allowing a malicious script to be invoked remotely.

CVE-2024-45608 [HIGH] CWE-89 CVE-2024-45608: GLPI is a free asset and IT management software package. An authenticated user can perfom a SQL inje GLPI is a free asset and IT management software package. An authenticated user can perfom a SQL injection by changing its preferences. Upgrade to 10.0.17.

CVE-2017-11184 [CRITICAL] CWE-89 CVE-2017-11184: SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter. SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter.

CVE-2026-22247 [CRITICAL] CWE-918 CVE-2026-22247: GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLP GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLPI administrator can perform SSRF request through the Webhook feature. This issue has been patched in version 11.0.5.

CVE-2024-41679 [HIGH] CWE-89 CVE-2024-41679: GLPI is a free asset and IT management software package. An authenticated user can exploit a SQL inj GLPI is a free asset and IT management software package. An authenticated user can exploit a SQL injection vulnerability from the ticket form. Upgrade to 10.0.17.

CVE-2023-28838 [HIGH] CWE-89 CVE-2023-28838: GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versi GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 9.5.13 and 10.0.7, a SQL Injection vulnerability allow users with access rights to statistics or reports to extract all data from database and, in some cases, write a webshell on the server. Versions 9.5.13 and 10.0.7 contain a patch for this issue.

CVE-2017-11329 [CRITICAL] CWE-89 CVE-2017-11329: GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entity_restr GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entity_restrict parameter that is not a list of integers.

CVE-2026-53625 [HIGH] CWE-862 CVE-2026-53625: GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a techn GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a super-administrator's authentication method and enable acco