← Volver a CVEs

CVE-2025-64516

HIGH

7.5

Descripcion

GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset, ...). If the public FAQ is enabled, this unauthorized access can be performed by an anonymous user. This vulnerability is fixed in 10.0.21 and 11.0.3.

Detalles CVE

Puntuacion CVSS v3.17.5

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado1/15/2026

Ultima modificacion1/21/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

glpi-project:glpi

Debilidades (CWE)

CWE-284CWE-639

Referencias

https://github.com/glpi-project/glpi/commit/51412a89d3174cfe22967b051d527febdbceab3c(security-advisories@github.com)

https://github.com/glpi-project/glpi/commit/ee7ee28e0645198311c0a9e0c4e4b712b8788e27(security-advisories@github.com)

https://github.com/glpi-project/glpi/releases/tag/10.0.21(security-advisories@github.com)

https://github.com/glpi-project/glpi/releases/tag/11.0.3(security-advisories@github.com)

https://github.com/glpi-project/glpi/security/advisories/GHSA-487h-7mxm-7r46(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.