CVE-2024-27098: Blind Server-Side Request Forgery (SSRF) using Arbitrary Object Instantiation in GLPI

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 35.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-18 · updated 2026-06-17
Weakness: CWE-918

Description

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using Arbitrary Object Instantiation. This issue has been patched in version 10.0.13.

Affected products

glpi-project glpi: from 9.5.0 before 10.0.13 — fixed in 10.0.13

How to fix

Upgrade to a fixed version: glpi-project glpi 10.0.13. Check the vendor advisory for mitigations.

References

https://github.com/glpi-project/glpi/commit/3b6bc1b4aa1f3693b20ada3425d2de5108522484
https://github.com/glpi-project/glpi/releases/tag/10.0.13
https://github.com/glpi-project/glpi/security/advisories/GHSA-92x4-q9w5-837w
https://github.com/glpi-project/glpi/commit/3b6bc1b4aa1f3693b20ada3425d2de5108522484
https://github.com/glpi-project/glpi/releases/tag/10.0.13
https://github.com/glpi-project/glpi/security/advisories/GHSA-92x4-q9w5-837w

Get alerted when CVE-2024-27098 or the next vulnerability affects your stack