CVE-2024-37149: GLPI-Project GLPI

High severity, CVSS 8.8. EPSS: 21.1% chance of exploitation in the next 30 days.

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated technician user can upload a malicious PHP script and hijack the plugin loader to execute this malicious script. Upgrade to 10.0.16.

Affected products

• GLPI-Project GLPI: from 0.85, before 10.0.16 (fixed in 10.0.16)

Published 2024-07-10. Last modified 2026-06-17.