GHSA-v774-5g3p-vxg2: GLPI: Blind Time based SQLI in dropdowns

Published Nov 4, 2026

Updated

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown values fetching endpoint that are incorporated into a database query. This permits SQL injection through the dropdown endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GLPI to a version that resolves this vulnerability.
Fixed in 11.0.8
Upgrade
Upgrade GLPI to a version that resolves this vulnerability.
Fixed in 10.0.26

Event History

Nov 4, 2026

CVE Published

via OSV·10:24 PM

Data Sourced

via OSV·10:24 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated GLPI user can exploit it by sending crafted values to the dropdown values fetching endpoint. No additional privileges or user interaction are required.

Which deployments are affected?

GLPI versions from 9.4.0 through versions before 10.0.26 and 11.0.8 are affected. The issue is fixed in 10.0.26 and 11.0.8.

What is the impact of successful exploitation?

The vulnerable endpoint permits SQL injection. The reported severity vector indicates potential high impact to the confidentiality, integrity, and availability of the vulnerable GLPI system.

GHSA-v774-5g3p-vxg2: GLPI: Blind Time based SQLI in dropdowns

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What is the impact of successful exploitation?