CVE-2025-64516: GLPI incorrectly authorizes access to documents

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-15 · updated 2026-06-17
Weakness: CWE-284

Description

GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset, ...). If the public FAQ is enabled, this unauthorized access can be performed by an anonymous user. This vulnerability is fixed in 10.0.21 and 11.0.3.

Affected products

glpi-project glpi: from 10.0.0 before 10.0.21; from 11.0.0 before 11.0.3 — fixed in 10.0.21, 11.0.3

How to fix

Upgrade to a fixed version: glpi-project glpi 10.0.21, 11.0.3. Check the vendor advisory for mitigations.

References

https://github.com/glpi-project/glpi/commit/51412a89d3174cfe22967b051d527febdbceab3c
https://github.com/glpi-project/glpi/commit/ee7ee28e0645198311c0a9e0c4e4b712b8788e27
https://github.com/glpi-project/glpi/releases/tag/10.0.21
https://github.com/glpi-project/glpi/releases/tag/11.0.3
https://github.com/glpi-project/glpi/security/advisories/GHSA-487h-7mxm-7r46

Get alerted when CVE-2025-64516 or the next vulnerability affects your stack