All vulnerabilities
CVE-2026-53629GHSA-cpcj-x335-5cmh

GLPI: SQL injection in history tab

glpi-project glpi
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationScanner template publicA Nuclei template detects it. Not in the KEV catalogNuclei
Exploit odds (EPSS)1.02%Chance of exploitation activity in the next 30 days, higher than 63% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published25 Sep 2026Updated 25 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Public exploit code and templates 1

  • Scanner templateGLPI - Blind SQL Injection in History Log Filter (LogBleed)Nuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.

Text from CVE List

Affected versions 2

  • glpiaffected: >= 9.4.0, < 10.0.26CVE List
  • glpiaffected: >= 11.0.0, < 11.0.8CVE List

References 5