CVE-2025-21626: GLPI vulnerable to exposure of sensitive information in the `status.php` endpoint
GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the status.php endpoint. Version 10.0.18 contains a fix for the issue. Some workarounds are available. One may delete the status.php file, restrict its access, or remove any sensitive values from the name field of the active LDAP directories, mail servers authentication providers and mail receivers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21626?
The severity of CVE-2025-21626 is critical due to the potential exposure of sensitive information to unauthorized users.
How do I fix CVE-2025-21626?
To fix CVE-2025-21626, upgrade your GLPI installation to version 10.0.18 or later.
What versions of GLPI are affected by CVE-2025-21626?
GLPI versions starting from 0.71 and prior to 10.0.18 are affected by CVE-2025-21626.
Can I use any workarounds for CVE-2025-21626?
Yes, there are workarounds available for CVE-2025-21626, but upgrading to the latest version is the recommended solution.
Is anonymous access to the status.php endpoint a concern in CVE-2025-21626?
Yes, anonymous access to the status.php endpoint is a significant concern as it allows unauthorized users to fetch sensitive information.