Medium severity5.8NVD Advisory· Published Feb 25, 2025· Updated Jun 17, 2026
CVE-2025-21626
CVE-2025-21626
Description
GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the status.php endpoint. Version 10.0.18 contains a fix for the issue. Some workarounds are available. One may delete the status.php file, restrict its access, or remove any sensitive values from the name field of the active LDAP directories, mail servers authentication providers and mail receivers.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*range: >=0.71,<10.0.18
- (no CPE)range: >=0.71, <10.0.18
- (no CPE)range: >= 0.71, < 10.0.18
Patches
Vulnerability mechanics
References
2- github.com/glpi-project/glpi/security/advisories/GHSA-5vvr-pxwf-3w77nvdVendor Advisory
- github.com/glpi-project/glpi/releases/tag/10.0.18nvdRelease Notes
News mentions
0No linked articles in our index yet.