CVE-2025-21626: GLPI-Project GLPI

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the `status.php` endpoint. Version 10.0.18 contains a fix for the issue. Some workarounds are available. One may delete the `status.php` file, restrict its access, or remove any sensitive values from the `name` field of the active LDAP directories, mail servers authentication providers and mail receivers.

Affected products

• GLPI-Project GLPI: from 0.71, before 10.0.18 (fixed in 10.0.18)

Published 2025-02-25. Last modified 2026-06-17.