CVE-2025-24801 HIGH

CVE-2025-24801: GLPI allows authenticated remote code execution

Vendor Glpi-Project

Product glpi

Weakness CWE-434 · Unrestricted file upload

Published March 18, 2025

Last update March 18, 2025

View on NVD All CVEs

CVSS base score

8.6/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

GLPI is a free asset and IT management software package. An authenticated user can upload and force the execution of *.php files located on the GLPI server. This vulnerability is fixed in 10.0.18.

Key dates

02Disclosure timeline

March 18, 2025 CVE published

March 18, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-24801 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html