CVE-2025-25192

Published: Feb 25, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

GLPI is a free asset and IT management software package. Prior to version 10.0.18, a low privileged user can enable debug mode and access sensitive information. Version 10.0.18 contains a patch. As a workaround, one may delete the `install/update.php` file.

Affected (1)

Products: Glpi Project: Glpi

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Glpi Project Glpi	Before 10.0.18

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

https://github.com/glpi-project/glpi/releases/tag/10.0.18

Source: security-advisories@github.com

Release Notes

https://github.com/glpi-project/glpi/security/advisories/GHSA-86cx-hcfc-8mm8

Source: security-advisories@github.com

Third Party Advisory

https://www.vicarius.io/vsociety/posts/cve-2025-25192-detection-glpi-vulnerability

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.vicarius.io/vsociety/posts/cve-2025-25192-mitigation-glpi-vulnerability

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.