SQL Injection Vulnerability in GLPI Asset Management Software by GLPI Project
CVE-2026-25936

6.5MEDIUM

Key Information:

Vendor

GLPI Project
Status
Glpi
Vendor
CVE Published:
17 March 2026

What is CVE-2026-25936?

A vulnerability exists in the GLPI Asset and IT management software that allows authenticated users to execute unauthorized SQL queries. This weakness affects versions 11.0.0 to 11.0.5, which can potentially lead to data leakage or modification. Version 11.0.6 includes a patch that addresses this issue and is recommended for all users. For more information, visit the advisory at the GLPI Project's GitHub link.

Affected Version(s)

glpi >= 11.0.0, < 11.0.6

References

https://github.com/glpi-project/glpi/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.