GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, an authenticated user can perform a SQL injection via the log…

Published:

5 april 2026 om 22:00:00

Alert date:

6 april 2026 om 16:03:20

Source:

nvd.nist.gov

Enterprise Applications, Database & Storage

GLPI, a free asset and IT management software package, contains a SQL injection vulnerability in versions 10.0.0 to before 10.0.24 and 11.0.6. An authenticated user can exploit this vulnerability through the logs export feature to perform SQL injection attacks. The vulnerability has been patched in versions 10.0.24 and 11.0.6. This affects organizations using GLPI for IT asset management and could allow authenticated attackers to access or manipulate database information.

Technical details

Mitigation steps:

Affected products:

GLPI