glpi
12.0.2GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.
- Maintenance
- Active769 commits in 3 months · bus factor 2
- License
- GPL-3.0Copyleft · OSI-approved
- Security
- 30 advisories2 critical, 23 high, 5 medium · Scorecard 7.2/10
- Supported versions
- No scheduleendoflife.date does not track this project
6.6k stars · 1.9k forks · 495 open issues · last release 3 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 2 critical, 23 high, 5 medium. Check the patched version against the one you run.
- highGHSA-5pgp-cfq7-4j9hNov 2, 2026Improper rights checks in users deletion
- Affected
- < 11.0.0; >= 11.0.0
- Patched in
- 10.0.28; 11.0.10
- highCVE-2026-57150Nov 2, 2026Authorization bypass in massive actions
- Affected
- < 11.0.0; >= 11.0.0
- Patched in
- 10.0.28; 11.0.10
- highCVE-2026-57151Nov 2, 20262FA deactivation/modification on users with higher privileges
- Affected
- >= 11.0.0
- Patched in
- 11.0.10
- highGHSA-pjj6-ww22-86qhNov 2, 2026SQL Injection through form actors dropdown
- Affected
- >= 11.0.0
- Patched in
- 11.0.10
- highGHSA-c46f-4v9j-5gpcNov 2, 2026Privilege escalation via user cloning
- Affected
- >= 9.5.0, < 11.0.0; >= 11.0.0
- Patched in
- 10.0.28; 11.0.10
- highGHSA-47mc-679g-2jrvNov 2, 2026Reflected XSS in the dashboard search result widget
- Affected
- >= 11.0.0
- Patched in
- 11.0.10
- highGHSA-rvrc-4jr9-wm5cOct 26, 2026MFA bypass by another GLPI user
- Affected
- > 11.0.0
- Patched in
- 11.0.9
- highGHSA-7x93-gxc8-jp8mOct 26, 2026Stored XSS via asset name
- Affected
- >= 11.0.0
- Patched in
- 11.0.9
- highGHSA-m9x5-44w4-jj4gOct 26, 2026Arbitrary files deletion during documents creation
- Affected
- >= 0.78, < 11.0.0; >= 11.0.0
- Patched in
- 10.0.27; 11.0.9
- highGHSA-75jp-p2vm-9vmhOct 26, 2026Stored XSS in ticket actors
- Affected
- >= 11.0.0
- Patched in
- 11.0.9
- highGHSA-3rr2-mxv6-rmc2Oct 26, 2026MFA bypass via password reset
- Affected
- >= 11.0.0
- Patched in
- 11.0.9
- highGHSA-5jg3-2qx2-gq7gOct 26, 2026Unexpected X509 authentication success with unverified certificated
- Affected
- >= 11.0.0; >= 0.71, < 11.0.0
- Patched in
- 11.0.9; 10.0.27
- highGHSA-753w-2942-4pxmOct 26, 2026Unauthenticated SQL injection in planning feature
- Affected
- From 11.0.0 until 11.0.8
- Patched in
- 11.0.9
- highGHSA-hv93-qr6v-7mpjOct 26, 2026Race condition in marketplace allowing malicious plugin installation
- Affected
- >= 9.5.0, < 11.0.0; >= 11.0.0
- Patched in
- 10.0.27; 11.0.9
- highGHSA-pr87-h373-xr6cOct 26, 2026Upload of malicious page on the web-server
- Affected
- >= 9.3.0, < 11.0.0; >= 11.0.0
- Patched in
- 10.0.27; 11.0.9
- highGHSA-wrcp-j8fp-pfvxOct 26, 2026Stored XSS in network equipement models
- Affected
- >= 11.0.0
- Patched in
- 11.0.9
- mediumGHSA-j5vx-jrmw-2498Oct 7, 2026Users names enumaration via the planning feature
- Affected
- >= 9.2.0, < 11.0.0; >= 11.0.0
- Patched in
- 10.0.28; 11.0.10
- mediumGHSA-5fw5-vgrw-ggp5Oct 7, 2026Missing authorization checks in the planning feature
- Affected
- >= 9.1.0, < 11.0.0; >= 11.0.0
- Patched in
- 10.0.28; 11.0.10
- mediumCVE-2026-128078Oct 7, 2026Unexpected access to followups/tasks/solutions generated from templates
- Affected
- >= 9.5.0, < 11.0.0; >= 11.0.0
- Patched in
- 10.0.27; 11.0.9
- mediumCVE-2026-53631Oct 7, 2026Unauthorized visibility expansion of knowbase items, reminders and RSS feeds
- Affected
- >= 0.83, < 11.0.0; >= 11.0.0
- Patched in
- 10.0.27; 11.0.9
- highGHSA-7rqw-r5p3-ff92Oct 7, 2026XSS via form illustration import
- Affected
- >= 11.0.0
- Patched in
- 11.0.9
- highCVE-2026-55214Jul 27, 2026Stored XSS in suppliers
- Affected
- >= 11.0.6
- Patched in
- 11.0.8
- mediumCVE-2026-57152Jul 27, 2026Unallowed notifications sending
- Affected
- >= 0.85, < 11.0.0; >= 11.0.0
- Patched in
- 10.0.26; 11.0.8
- highCVE-2026-53610Jul 27, 2026Reflected XSS in dashboards
- Affected
- >= 11.0.0
- Patched in
- 11.0.8
- highCVE-2026-53629Jul 27, 2026SQL injection in history tab
- Affected
- >= 9.4.0, < 11.0.0; >= 11.0.0
- Patched in
- 10.0.26; 11.0.8
- criticalCVE-2026-52848Jul 27, 2026MFA bypass
- Affected
- >= 11.0.0
- Patched in
- 11.0.8
- highCVE-2026-53625Jul 27, 2026Privilege Escalation via authtype API manipulation
- Affected
- >= 0.70, < 11.0.0; >= 11.0.0
- Patched in
- 10.0.26; 11.0.8
- highCVE-2026-47678Jul 27, 2026SQL injection in dropdowns
- Affected
- >= 9.4.0, < 11.0.0; >= 11.0.0
- Patched in
- 10.0.26; 11.0.8
- highCVE-2026-47679Jul 27, 2026Arbitrary file deletion
- Affected
- >= 10.0.0, < 11.0.0; >= 11.0.0
- Patched in
- 10.0.26; 11.0.8
- criticalCVE-2026-48482Jul 27, 2026RCE via Form import
- Affected
- >= 11.0.0
- Patched in
- 11.0.8