CVE-2022-35914: Teclib GLPI Remote Code Execution Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-03-07. EPSS: 99.9% chance of exploitation in the next 30 days.

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

Affected products

• GLPI-Project GLPI: up to and including 10.0.2

Published 2022-09-19. Last modified 2026-06-17.