CVE-2022-31062: Unauthenticated Local File Inclusion

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-06-20 · updated 2026-06-17
Weakness: CWE-22

Description

### Impact A plugin public script can be used to read content of system files. ### Patches Upgrade to version 1.0.2. ### Workarounds `b/deploy/index.php` file can be deleted if deploy feature is not used.

Affected products

glpi-project glpi-inventory-plugin: before 1.0.2 — fixed in 1.0.2

How to fix

Upgrade to a fixed version: glpi-project glpi-inventory-plugin 1.0.2. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/171654/GLPI-Glpiinventory-1.0.1-Local-File-Inclusion.html
https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-q33f-jcjf-p4v9
http://packetstormsecurity.com/files/171654/GLPI-Glpiinventory-1.0.1-Local-File-Inclusion.html
https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-q33f-jcjf-p4v9

Get alerted when CVE-2022-31062 or the next vulnerability affects your stack