CVE-2021-39213: GLPI-Project GLPI

High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days.

GLPI is a free Asset and IT management software package. Starting in version 9.1 and prior to version 9.5.6, GLPI with API Rest enabled is vulnerable to API bypass with custom header injection. This issue is fixed in version 9.5.6. One may disable API Rest as a workaround.

Affected products

• GLPI-Project GLPI: from 9.1, before 9.5.6 (fixed in 9.5.6)

Published 2021-09-15. Last modified 2026-06-17.