CVE-2025-25192

Summary

GLPI is a free asset and IT management software package. Prior to version 10.0.18, a low privileged user can enable debug mode and access sensitive information. Version 10.0.18 contains a patch. As a workaround, one may delete the install/update.php file.

Affected Software

Weaknesses

• CWE-200: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

CVE Program Container

Additional References

• https://www.vicarius.io/vsociety/posts/cve-2025-25192-mitigation-glpi-vulnerability
• https://www.vicarius.io/vsociety/posts/cve-2025-25192-detection-glpi-vulnerability

References

• https://github.com/glpi-project/glpi/security/advisories/GHSA-86cx-hcfc-8mm8
• https://github.com/glpi-project/glpi/releases/tag/10.0.18

• ←Previous
• Next→