Vulnerability · Published Jul 30, 2025 · Assigned by GitHub_M

CVE-2025-52567GLPI has overly permissive URL verification

Low 3.5

In plain English

A low-severity server-side request forgery in glpi from glpi-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.2%top 87.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 0.84 through 10.0.18, usage of RSS feeds or external calendars when planning is subject to SSRF exploit. The previous security patches provided since GLPI 10.0.4 were not robust enough for certain specific cases. This is fixed in version 10.0.19.

Affected products (as reported)

Vendor	Product	Versions
glpi-project	glpi	>= 0.84, < 10.0.19

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-5mp6-mgmh-vrq7 x_refsource_CONFIRM