Glpi Project Glpi
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Glpi Project Glpi.
By the Year
In 2026 there have been 38 vulnerabilities in Glpi Project Glpi with an average score of 6.7 out of ten. Last year, in 2025 Glpi had 21 security vulnerabilities published. That is, 17 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.02.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 38 | 6.75 |
| 2025 | 21 | 6.73 |
| 2024 | 32 | 6.96 |
| 2023 | 35 | 7.43 |
| 2022 | 29 | 6.55 |
| 2021 | 14 | 6.26 |
| 2020 | 18 | 6.53 |
| 2019 | 6 | 4.45 |
| 2018 | 3 | 8.80 |
It may take a day or so for new Glpi vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Glpi Project Glpi Security Vulnerabilities
GLPI SQLi via history tab URL in 9.4.0-10.0.26 / 11.0.8 (fixed)
CVE-2026-53629
7.1 - High
- September 25, 2026
GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.
SQL Injection
GLPI 11.0.5-11.0.7 Permission Logic Bypass Exposing Docs
CVE-2026-53626
7.1 - High
- September 25, 2026
GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can use an unrelated item that the user is permitted to view to read a document linked to an inaccessible item. This issue is fixed in version 11.0.8.
Insecure Direct Object Reference / IDOR
GLPI 11.0.0-11.0.8 Directory Traversal & Remote Code Exec via Form Import
CVE-2026-48482
9.4 - Critical
- September 25, 2026
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location, allowing a malicious script to be invoked remotely. This issue is fixed in version 11.0.8.
Directory traversal
GLPI API AuthType Manipulation Enables Account Takeover (10.0.26/11.0.8)
CVE-2026-53625
7.5 - High
- September 25, 2026
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a super-administrator's authentication method and enable account takeover. This issue is fixed in versions 11.0.8 and 10.0.26.
AuthZ
GLPI <11.0.8 XSS via Crafted Dashboard URL Reflected Attack
CVE-2026-53610
7.5 - High
- September 25, 2026
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. This issue is fixed in version 11.0.8.
XSS
GLPI <=10.0.26 & <=11.0.8 pathvalidation allows file deletion
CVE-2026-47679
8.5 - High
- September 25, 2026
GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions 11.0.8 and 10.0.26.
Directory traversal
GLPI 11.0.6-11.0.8 Stored XSS via supplier website field
CVE-2026-55214
8.5 - High
- September 25, 2026
GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8.
Output Sanitization
GLPI 11.0.0-11.0.8 MFA TOTP brute force via unsanitized verification endpoint
CVE-2026-49470
7.7 - High
- September 25, 2026
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against the MFA verification flow, making brute-force compromise of the second factor and subsequent account takeover possible. This issue is fixed in version 11.0.8.
Improper Restriction of Excessive Authentication Attempts
GLPI <=10.0.26/11.0.8: Auth. users can modify KB comments/translations
CVE-2026-55217
5.3 - Medium
- September 25, 2026
GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0.8 and 10.0.26.
AuthZ
GLPI 10.0.26/11.0.8: Auth Escalation via Disabled 2FA for External Users
CVE-2026-53628
5.9 - Medium
- September 25, 2026
GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator's entity scope. The affected user-account administration flow did not consistently enforce the target user's entity-scoped update permission. This issue is fixed in versions 11.0.8 and 10.0.26.
AuthZ
GLPI Debug Mode Privilege Escalation before 10.0.26/11.0.8
CVE-2026-45801
5.3 - Medium
- September 25, 2026
GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege boundary intended to restrict debug-mode activation. This issue is fixed in versions 11.0.8 and 10.0.26.
Improper Privilege Management
GLPI API v2 Low-Priv Auth Update Bypass <=11.0.8
CVE-2026-53627
6 - Medium
- September 25, 2026
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently enforce the applicable authorization checks. This issue is fixed in version 11.0.8.
AuthZ
LDAP Filter Bypass via User Import in GLPI <11.0.8
CVE-2026-49469
4.6 - Medium
- September 25, 2026
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter was intended to exclude. This issue is fixed in versions 11.0.8 and 10.0.26.
LDAP Injection
GLPI 11 Tag Plug 2.14.4 XSS via Unsanitized Tag Name
CVE-2026-53987
6.4 - Medium
- July 09, 2026
The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent() without output escaping, resulting in stored cross-site scripting. An authenticated user with TAG MANAGEMENT create or update rights can set a tag name containing HTML, which then executes in the browser of any user who opens the Kanban view of a ticket, problem, change, or project the tag is attached to.
XSS
GLPI <11.0.8 Doc Handler auth bypass via docid in front/document.send.php
CVE-2026-13490
3.7 - Low
- June 28, 2026
A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7. This affects the function Document::canViewFile of the file front/document.send.php of the component Document Handler. Such manipulation of the argument docid leads to authorization bypass. The attack can be executed remotely. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure.
Insecure Direct Object Reference / IDOR
GLPI 10.0.4-10.0.24 XSS Asset Locked Tab
CVE-2026-42321
- June 03, 2026
GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to version 10.0.25, a technician can store an XSS payload in the asset locked tab. Upgrade to 10.0.25 or 11.0.7 to receive a patch.
XSS
GLPI Arbitrary File Read in GLPI_DOC_DIR (v0.50 <10.0.25/11.0.7)
CVE-2026-42320
- June 03, 2026
GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 10.0.25 and 11.0.7, a technician can read arbitrary files inside the GLPI_DOC_DIR. Upgrade to 10.0.25 or 11.0.7 to receive a patch.
AuthZ
GLPI <=10.0.24: Low-Priv Planning Deletion PrivEsc
CVE-2026-42318
7 - High
- June 03, 2026
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 10.0.25 and 11.0.7, low privilege users with access to planning can delete any object in GLPI. Upgrade to 11.0.7 or 10.0.25 to receive a patch. As a workaround, disable delete rights for User's planning.
AuthZ
GLPI <10.0.25/11.0.7 Arbitrary File Deletion via Technician Access
CVE-2026-42317
- June 03, 2026
GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, a technician can delete arbitrary files from the filesystem as long as the webserver has write rights on them. Upgrade to 10.0.25 or 11.0.7 to receive a patch.
AuthZ
GLPI 10.0.25 Authenticated Asset Read via Config READ
CVE-2026-44281
- June 03, 2026
GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, an authenticated user with config READ permission can read a specific asset object. Upgrade to 11.0.7 or 10.0.25 to receive a patch.
AuthZ
GLPI <=11.0.6 Stored XSS in ITIL Costs (fixed 11.0.7)
CVE-2026-40108
- June 02, 2026
GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, a technician can store an XSS payload in a ITIL costs. This issue has been fixed in version 11.0.7.
XSS
GLPI < 11.0.7: Unauth Write Access to KB Allows XSS
CVE-2026-5385
- June 02, 2026
An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item. This issue affects glpi: before 11.0.7.
XSS
GLPI <11.0.7: Authenticated Form Export Disclosure via Forms READ
CVE-2026-32312
- May 18, 2026
GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, an authenticated user with forms READ permission can export the structure of unauthorized forms. This issue has been fixed in version 11.0.7.
AuthZ
GLPI SQL injection via Log Export pre-10.0.24/11.0.6
CVE-2026-29047
7.2 - High
- April 06, 2026
GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, an authenticated user can perform a SQL injection via the logs export feature. This vulnerability is fixed in 10.0.24 and 11.0.6.
SQL Injection
GLPI 11.0.0-11.0.5 Blind SQLi in Search Engine
CVE-2026-26263
8.1 - High
- April 06, 2026
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based blind SQL injection exists in GLPI's Search engine. This vulnerability is fixed in 11.0.6.
SQL Injection
GLPI 11.0.0-11.0.5 Inventory XSS Fixed in 11.0.6
CVE-2026-26027
7.5 - High
- April 06, 2026
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. This vulnerability is fixed in 11.0.6.
XSS
GLPI 11.0.0-11.0.5 RCE via admin template injection
CVE-2026-26026
9.1 - Critical
- April 06, 2026
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in 11.0.6.
Code Injection
GLPI XSS via Supplier Field, Auth, Fixed in 10.0.24
CVE-2026-25932
7.2 - High
- April 06, 2026
GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier fields. This vulnerability is fixed in 10.0.24.
Output Sanitization
GLPI Inventory Plugin <=1.6.5 SQLi via unsanitized report input
CVE-2026-26001
7.1 - High
- March 17, 2026
The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, non sanitized user input can lend to an SQL injection from reports, with adequate rights. This vulnerability is fixed in 1.6.6.
SQL Injection
GLPI MFA Bypass v11.0.0-11.0.5 (Fix in 11.0.6)
CVE-2026-25937
6.5 - Medium
- March 17, 2026
GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's credentials can bypass MFA and steal their account. Version 11.0.6 fixes the issue.
authentification
GLPI <11.0.6 Authenticated SQLi
CVE-2026-25936
6.5 - Medium
- March 17, 2026
GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can perfom a SQL injection. Version 11.0.6 fixes the issue.
SQL Injection
GLPI 11.0.0-11.0.4 PHP File Upload Execution (pre-11.0.5)
CVE-2026-22248
8.1 - High
- March 11, 2026
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. From 11.0.0 to before 11.0.5, an authenticated technician user can upload a malicious file and trigger its execution through an unsafe PHP instantiation. This vulnerability is fixed in 11.0.5.
Marshaling, Unmarshaling
GLPI Inventory Plugin 1.6.6 Reflected XSS in Task Jobs (Before 1.6.6)
CVE-2026-25590
4.5 - Medium
- March 03, 2026
The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, there is a reflected XSS vulnerability in task jobs. This vulnerability is fixed in 1.6.6.
XSS
GLPI 0.8510.0.23 Authenticated SQL Injection
CVE-2026-22044
6.5 - Medium
- February 04, 2026
GLPI is a free asset and IT management software package. From version 0.85 to before 10.0.23, an authenticated user can perform a SQL injection. This issue has been patched in version 10.0.23.
SQL Injection
GLPI SSO session hijacking in v0.71-10.0.23/11.0.5
CVE-2026-23624
4.3 - Medium
- February 04, 2026
GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used, based on SSO variables, a user can steal a GLPI session previously opened by another user on the same machine. This issue has been patched in versions .
Session Fixation
GLPI SSRF via Webhook before 11.0.5
CVE-2026-22247
4.1 - Medium
- February 04, 2026
GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLPI administrator can perform SSRF request through the Webhook feature. This issue has been patched in version 11.0.5.
SSRF
GLPI 11.0.0-11.0.3 SQLi via inventory endpoint (unauthenticated)
CVE-2025-66417
7.5 - High
- January 15, 2026
GLPI is a free asset and IT management software package. From 11.0.0, < 11.0.3, an unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 11.0.3.
SQL Injection
GLPI Unauthorized Document Access Pre 10.0.21/11.0.3
CVE-2025-64516
7.5 - High
- January 15, 2026
GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset, ...). If the public FAQ is enabled, this unauthorized access can be performed by an anonymous user. This vulnerability is fixed in 10.0.21 and 11.0.3.
Authorization
GLPI 9.5.7 Username enumeration via password reset
CVE-2023-53943
5.3 - Medium
- December 18, 2025
GLPI 9.5.7 contains a username enumeration vulnerability in the lost password recovery mechanism that allows attackers to validate email addresses. Attackers can systematically test email addresses by submitting requests to the password reset endpoint and analyzing response differences to identify valid user accounts.
Side Channel Attack
GLPI 9.1.0-<10.0.21: API Exposes Knowledge Base (CVE-2025-64520)
CVE-2025-64520
6.5 - Medium
- December 16, 2025
GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.21, an unauthorized user with an API access can read all knowledge base entries. Users should upgrade to 10.0.21 to receive a patch.
AuthZ
GLPI 10.0.0-10.0.20 XSS via Inventory Endpoint before 10.0.21
CVE-2025-59935
6.5 - Medium
- December 16, 2025
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.21, an unauthenticated user can store an XSS payload through the inventory endpoint. Users should upgrade to 10.0.21 to receive a patch.
XSS
GLPI Inventory Plugin <=1.5.0 SQL Injection (fixed 1.5.1)
CVE-2025-32786
7.5 - High
- November 04, 2025
The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Versions 1.5.0 and below are vulnerable to SQL Injection. This issue is fixed in version 1.5.1.
SQL Injection
GLPI 0.80-10.0.18 Unauth Access (CVE-2025-53111)
CVE-2025-53111
- July 30, 2025
GLPI is a Free Asset and IT Management Software package. In versions 0.80 through 10.0.18, a lack of permission checks can result in unauthorized access to some resources. This is fixed in version 10.0.19.
Authorization
GLPI Privilege Escalation: Alter Reservations 0.78-10.0.18 (Fixed 10.0.19)
CVE-2025-53357
- July 30, 2025
GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.78 through 10.0.18, a connected user can alter the reservations of another user. This is fixed in version 10.0.19.
Insecure Direct Object Reference / IDOR
GLPI 0.65-10.0.18 External Links Info Disclosure (fixed 10.0.19)
CVE-2025-53113
- July 30, 2025
GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.65 through 10.0.18, a technician can use the external links feature to fetch information on items they do not have the right to see. This is fixed in version 10.0.19.
Authorization
GLPI 9.1-10.0.18 Permission Check RCE
CVE-2025-53112
- July 30, 2025
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.1.0 through 10.0.18, a lack of permission checks can result in unauthorized removal of some specific resources. This is fixed in version 10.0.19.
Authorization
GLPI 10.0.18 Planning Feature XSS/Phishing Vulnerability
CVE-2025-52897
6.1 - Medium
- July 30, 2025
GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19.
Open Redirect
GLPI <10.0.19 SSRF in RSS/External Calendar Planning (CVE-2025-52567)
CVE-2025-52567
5 - Medium
- July 30, 2025
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 0.84 through 10.0.18, usage of RSS feeds or external calendars when planning is subject to SSRF exploit. The previous security patches provided since GLPI 10.0.4 were not robust enough for certain specific cases. This is fixed in version 10.0.19.
SSRF
Credential Theft via Malicious Payload in GLPI 9.3.1-10.0.19
CVE-2025-53008
- July 30, 2025
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.3.1 through 10.0.19, a connected user can use a malicious payload to steal mail receiver credentials. This is fixed in version 10.0.19.
Insufficiently Protected Credentials
GLPI <=10.0.18 Stored XSS Kanban (fixed 10.0.19)
CVE-2025-27514
5.4 - Medium
- July 29, 2025
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 9.5.0 through 10.0.18, a technician can use a malicious payload to trigger a stored XSS on the project's kanban. This is fixed in version 10.0.19.
XSS
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Glpi Project Glpi or by Glpi Project? Click the Watch button to subscribe.
