What’s Vulnerable › Vulnerabilities

CVE-2025-24022: iTop server vulnerable to portal code injection

• Severity: high (CVSS 8.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-14 · updated 2026-06-17
• Weakness: CWE-78

Description

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, server code execution is possible through the frontend of iTop's portal. This is fixed in versions 2.7.12, 3.1.3 and 3.2.1.

Affected products

• Combodo iTop: before 2.7.12; from 3.0.0 before 3.1.3; from 3.2.0 before 3.2.1 — fixed in 2.7.12, 3.1.3, 3.2.1

How to fix

Upgrade to a fixed version: Combodo iTop 2.7.12, 3.1.3, 3.2.1. Check the vendor advisory for mitigations.

References

• https://github.com/Combodo/iTop/commit/082d865efaf8a349b60fe3875e9c726c24f8a8bd
• https://github.com/Combodo/iTop/commit/37fc1a572380f2faa67fddea5b1a3a4ba72ed54e
• https://github.com/Combodo/iTop/commit/5780f26817c2303c5bdd0ad16e21d4d959780b0b
• https://github.com/Combodo/iTop/security/advisories/GHSA-rhv2-wfrr-4j2j

Get alerted when CVE-2025-24022 or the next vulnerability affects your stack