CVE-2025-21619 is a critical SQL injection flaw (CVSS 9.8 in NVD) in GLPI, the open source IT asset and service management package. An administrator can trigger it through the rules configuration forms. The fix is in version 10.0.18, so upgrade to that release or later.
What's affected
- Product: GLPI, the free asset and IT management software
- Affected versions: releases before 10.0.18, based on the advisory's patched version
- Fixed version: 10.0.18
- Vulnerable area: the rules configuration forms
- CVSS: 9.8 (Critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Published: 2025-03-18
The score needs a note. NVD lists it as 9.8 with no privileges required, but the project's own advisory rates it High at 8.2 on the CVSS v4 scale and lists high privileges as required, because the flaw is reached by an administrator. The record's description agrees: an administrator user can perform the injection. The advisory's only listed remedy is to upgrade to 10.0.18. The CISA Known Exploited Vulnerabilities flag is false for this CVE, and none of the pages I read report active exploitation.
How to check if you're exposed
Find the GLPI version in the web interface, where it is shown in the page footer after you log in, or in the Setup and General screens. Compare it with 10.0.18.
# if GLPI is installed from source, look at the version constant in the tree
grep -rn "GLPI_VERSION" /var/www/glpi --include=*.php | head
Any 10.0.x release below 10.0.18 is in scope. The advisory's patched version is the only fixed version named, so do not rely on a hotfix of an older line unless the project says so.
Since the flaw is reached by an administrator, also list who holds administrator or rule editing rights. Look at the audit log for changes to rules you do not recognize. For an overall view of the libraries GLPI and its plugins pull in, use our free in-browser dependency scan on the project's lock files.
What to do now
- Upgrade GLPI to 10.0.18 or later, after taking a database and file backup.
- Review the list of accounts with administrator or rule management rights and remove any that are no longer needed.
- Turn on multi factor authentication for administrator accounts if your setup supports it.
- Check the rules list and the logs for changes you cannot explain, and keep a copy of the current rules.
- Keep GLPI's admin interface off the open internet where you can, or behind a VPN or an allowlist.
Why it matters
The weakness is CWE-89, SQL injection. Input from a rules configuration form reaches a database query without being kept apart from the query text, so a crafted value changes what the query does.
The administrator requirement lowers the odds, but it does not make the flaw harmless. Administrator accounts are common targets for phishing and password reuse, and an IT management tool holds a lot: inventory, user details, tickets and credentials stored for integrations. A bug that lets one admin session read the whole database is worth a quick patch. This is also a case where a clear fixed version exists, which makes it a good example of why matching fixes to your inventory saves time. The demo below shows that flow.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
GLPI 10.0.18, per the project's advisory. Upgrade to that or a later release.
Why do NVD and GLPI give different scores?
NVD scores the flaw as network reachable without privileges. The project rates it lower because an administrator account is needed. Patch either way.
Sources
Last reviewed: 19 October 2026.
