CVE-2025-64516

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-64516
GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset, ...). If the public FAQ is enabled, this unauthorized access can be performed by an anonymous user. This vulnerability is fixed in 10.0.21 and 11.0.3.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/glpi-project/glpi/commit/51412a89d3174cfe22967b051d527febdbceab3c Patch
https://github.com/glpi-project/glpi/commit/ee7ee28e0645198311c0a9e0c4e4b712b8788e27 Patch
https://github.com/glpi-project/glpi/releases/tag/10.0.21 Release Notes
https://github.com/glpi-project/glpi/releases/tag/11.0.3 Release Notes
https://github.com/glpi-project/glpi/security/advisories/GHSA-487h-7mxm-7r46 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*
cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*
History

21 Jan 2026, 20:53

Type Values Removed Values Added
References () https://github.com/glpi-project/glpi/commit/51412a89d3174cfe22967b051d527febdbceab3c - () https://github.com/glpi-project/glpi/commit/51412a89d3174cfe22967b051d527febdbceab3c - Patch
References () https://github.com/glpi-project/glpi/commit/ee7ee28e0645198311c0a9e0c4e4b712b8788e27 - () https://github.com/glpi-project/glpi/commit/ee7ee28e0645198311c0a9e0c4e4b712b8788e27 - Patch
References () https://github.com/glpi-project/glpi/releases/tag/10.0.21 - () https://github.com/glpi-project/glpi/releases/tag/10.0.21 - Release Notes
References () https://github.com/glpi-project/glpi/releases/tag/11.0.3 - () https://github.com/glpi-project/glpi/releases/tag/11.0.3 - Release Notes
References () https://github.com/glpi-project/glpi/security/advisories/GHSA-487h-7mxm-7r46 - () https://github.com/glpi-project/glpi/security/advisories/GHSA-487h-7mxm-7r46 - Vendor Advisory
CPE cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*
First Time Glpi-project
Glpi-project glpi

15 Jan 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-15 16:16

Updated : 2026-01-21 20:53

NVD link : CVE-2025-64516

Mitre link : CVE-2025-64516

CVE.ORG link : CVE-2025-64516

JSON object : View

Products Affected

glpi-project

  • glpi
CWE
CWE-284

Improper Access Control

CWE-639

Authorization Bypass Through User-Controlled Key