CVE-2025-24801CWE-434

GLPI allows authenticated remote code execution

High · published March 18, 2025

CVSS v3.1

8.6

EPSS

21%

Percentile

97.6

In the wild

Unconfirmed

What it is

GLPI is a free asset and IT management software package. An authenticated user can upload and force the execution of *.php files located on the GLPI server. This vulnerability is fixed in 10.0.18.

The record

Technical detail

CVSS v3.1: 8.6 · HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.20986 · 97.6th percentile
Weakness: CWE-434 · Unrestricted Upload of File with Dangerous Type
Published: 2025-03-18T18:32Z

EPSS history

Timeline

18 MAR 18:32Z
GLPI allows authenticated remote code execution
cvelistv5