Vulnerability · Published Sep 25, 2026 · Assigned by GitHub_M

CVE-2026-53629GLPI: SQL injection in history tab

High 7.1

In plain English

A high-severity SQL injection in glpi from glpi-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)1.0%top 36.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.

Affected products (as reported)

Vendor	Product	Versions
glpi-project	glpi	>= 9.4.0, < 10.0.26>= 11.0.0, < 11.0.8

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-cpcj-x335-5cmh x_refsource_CONFIRM
https://github.com/glpi-project/glpi/commit/1296798fb03295d07c1d97fa8483d1dbab59fef5 x_refsource_MISC
https://github.com/glpi-project/glpi/commit/80b86c0dcad2f6ece9b5da445d1c264a1dda3ce5 x_refsource_MISC
https://github.com/glpi-project/glpi/releases/tag/10.0.26 x_refsource_MISC
https://github.com/glpi-project/glpi/releases/tag/11.0.8 x_refsource_MISC