CVE-2022-34125: GLPI-Project Cmdb

Medium severity, CVSS 6.5. EPSS: 4.6% chance of exploitation in the next 30 days.

front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive information via a _log/ pathname in the file parameter.

Affected products

• GLPI-Project Cmdb: before 3.0.3 (fixed in 3.0.3)

Published 2023-04-16. Last modified 2026-06-17.