Glpi-Project Glpi vulnerabilities

CVE-2023-35940 [HIGH] CWE-284 CVE-2023-35940: GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to vers GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file allows an unauthenticated user to be able to access dashboards data. Version 10.0.8 contains a patch for this issue.

CVE-2026-26026 [HIGH] CWE-94 CVE-2026-26026: GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template inje GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in 11.0.6.

CVE-2024-47761 [HIGH] CWE-287 CVE-2024-47761: GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to versi GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an administrator with access to the sent notifications contents can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue.

CVE-2014-8360 [HIGH] CWE-22 CVE-2014-8360: Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote a Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote attackers to include and execute arbitrary local files via a .._ (dot dot underscore) in an item type to the getItemForItemtype, as demonstrated by the itemtype parameter in ajax/common.tabs.php.

CVE-2022-24867 [HIGH] CWE-200 CVE-2022-24867: GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, l GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the config to the javascript, some entries are filtered out. The variable ldap_pass is not filtered and when you look at the source code of the rendered page, we can see the password for the root dn.

CVE-2024-50339 [MEDIUM] CWE-79 CVE-2024-50339: GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to vers GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue.

CVE-2024-38370 [HIGH] CWE-285 CVE-2024-38370: GLPI is a free asset and IT management software package. Starting in 9.2.0 and prior to 11.0.0, it i GLPI is a free asset and IT management software package. Starting in 9.2.0 and prior to 11.0.0, it is possible to download a document from the API without appropriate rights. Upgrade to 10.0.16.

CVE-2021-39209 [HIGH] CWE-352 CVE-2021-39209: GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is l GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can bypass Cross-Site Request Forgery (CSRF) protection in many places. This could allow a malicious actor to perform many actions on GLPI. This issue is fixed in version 9.5.6. There are no workarounds aside from upgrading.

CVE-2026-55214 [HIGH] CWE-116 CVE-2026-55214: GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8.

CVE-2026-42321 [HIGH] CWE-79 CVE-2026-42321: GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to ver GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to version 10.0.25, a technician can store an XSS payload in the asset locked tab. Upgrade to 10.0.25 or 11.0.7 to receive a patch.

CVE-2020-11032 [HIGH] CWE-89 CVE-2020-11032: In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exp In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a technician account. This is fixed in version 9.4.6.

CVE-2026-42318 [HIGH] CWE-862 CVE-2026-42318: GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to vers GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 10.0.25 and 11.0.7, low privilege users with access to planning can delete any object in GLPI. Upgrade to 11.0.7 or 10.0.25 to receive a patch. As a workaround, disable delete rights for User's planning.

CVE-2026-25937 [MEDIUM] CWE-287 CVE-2026-25937: GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to ver GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's credentials can bypass MFA and steal their account. Version 11.0.6 fixes the issue.

CVE-2020-11031 [HIGH] CWE-327 CVE-2020-11031: In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data en In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The library chosen is sodium.

CVE-2020-15108 [HIGH] CWE-89 CVE-2020-15108: In glpi before 9.5.1, there is a SQL injection for all usages of "Clone" feature. This has been fixe In glpi before 9.5.1, there is a SQL injection for all usages of "Clone" feature. This has been fixed in 9.5.1.

CVE-2020-11035 [CRITICAL] CWE-327 CVE-2020-11035: In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecu In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm. The implementation uses rand and uniqid and MD5 which does not provide secure values. This is fixed in version 9.4.6.

CVE-2026-42317 [HIGH] CWE-862 CVE-2026-42317: GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versi GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, a technician can delete arbitrary files from the filesystem as long as the webserver has write rights on them. Upgrade to 10.0.25 or 11.0.7 to receive a patch.

CVE-2026-23624 [MEDIUM] CWE-384 CVE-2026-23624: GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10 GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used, based on SSO variables, a user can steal a GLPI session previously opened by another user on the same machine. This issue has been patched in versions .

CVE-2020-11033 [HIGH] CWE-200 CVE-2020-11033: In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype wil In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All api_tokens which can be used to do privileges escalations or read/update/delete data normally non accessible to the current user. - All personal_tokens can

CVE-2026-53626 [HIGH] CWE-639 CVE-2026-53626: GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain con GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can use an unrelated item that the user is permitted to view to read a document linked to an inaccessible item. This iss