CVE-2025-24799

GLPI allows unauthenticated SQL injection through the inventory endpoint

Exploitation likely. EPSS gives it a 87% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.17.5High EPSS percentile99th87% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2025-03-18Updated 2025-07-31Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you run GLPI and confirm its installed version.
Upgrade GLPI to version 10.0.18.
If the upgrade must wait, restrict access to the inventory endpoint to trusted systems.
Review database and web-server logs for unusual inventory-endpoint requests.

Vendor advisory Some work to apply

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.

In plain language

Written by AI from the record

GLPI versions before 10.0.18 let an outsider read information from its database, so small businesses using GLPI should update promptly.

Unauthenticated SQL injection (CWE-89) in the GLPI inventory endpoint can expose database contents over the network.

If you're affected

IT asset data exposure
User account data exposure
Configuration data exposure
Privacy incident risk

What is it

GLPI is software used to track IT equipment and manage IT work. This flaw is like leaving a back-office filing cabinet open through a service entrance: an outsider may be able to ask for information they should not see.

Who is affected

This matters to you if you use or run GLPI, especially to manage computers, software, users, or support work. It is a risk when the GLPI inventory endpoint is reachable by an attacker over your network.

How urgent is it

This is urgent because an attacker does not need a login to target the vulnerable endpoint. Although CISA has not listed it as actively exploited, the predicted likelihood of attack is extremely high and rising; treat this as a red-priority update.

What to do — in detail

Confirm the deployed GLPI version and identify every instance, including externally reachable production, test, and managed-hosting deployments. Upgrade affected installations to GLPI 10.0.18; the supplied remediation identifies 10.0.18 as the fixed target and does not provide separate branch-specific fixes. Before upgrading, follow the vendor release guidance, back up the application and database, test the update if you have a staging instance, then verify the installed version after deployment.

If patching is delayed, limit the inventory endpoint to known inventory agents or trusted network ranges through the reverse proxy, firewall, or access-control layer; remove broad public access where feasible. No CISA KEV remediation due date applies because this CVE is not listed in KEV. Review web-server and application logs for unexpected requests to the inventory endpoint and investigate unusual database errors or large, unexpected responses.

Technical context

CVE-2025-24799 is rated CVSS 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). It is CWE-89 SQL injection in GLPI's inventory endpoint, with network access, low attack complexity, no privileges, and no user interaction required; the stated impact is high confidentiality with no integrity or availability impact. EPSS predicts an 86.7% likelihood (100th percentile) and is rising. CISA KEV does not list this CVE. Exploit reporting indicates a detection template only, not confirmed weaponized exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

87% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 464 days, from the signal feeds we watch.

2026-06-25OpenVAS check added
2026-06-22EPSS band changemoderate → high
2026-04-20EPSS band changehigh → moderate
2026-03-06Nuclei check added
2025-07-31Patch availablerecord updated
2025-03-18Publishedweakness classified, att&ck mapped

Affected products

glpi-projectoss-project · FR
- glpiWeb AppOn-premEnterprise Software / itsm-monitoring
GLPI Projectoss-project · FRaka glpi inventory, glpi
- GLPIWeb AppOn-premEnterprise Software / itsm-monitoring

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact