CVE-2025-24801

Published Mar 18, 2025

Last updated 19 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-24801 affects GLPI, a free IT asset management software package. The vulnerability allows an authenticated user to upload and force the execution of *.php files located on the GLPI server. This issue has been addressed and fixed in GLPI version 10.0.18. An additional vulnerability with the ID of CVE-2025-24801 has been identified in GLPI version 10.0.17 and prior. This vulnerability is related to command injection, potentially allowing a remote attacker to execute arbitrary commands on the affected system.

Description: GLPI is a free asset and IT management software package. An authenticated user can upload and force the execution of *.php files located on the GLPI server. This vulnerability is fixed in 10.0.18.
Source: security-advisories@github.com
NVD status: Analyzed
Products: glpi

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-434

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7E2FC267-04C0-429B-91BD-B5E634AFBC4B",
            "versionEndExcluding": "10.0.18",
            "versionStartIncluding": "0.85"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.