The flaw is a classic authenticated SQL injection (CWE‑89) affecting GLPI versions 0.85 through 10.0.22. A user who has legitimate credentials can inject arbitrary SQL commands into the application, enabling read, write, or delete operations on the underlying database. This compromises confidentiality of asset data and could provide a foothold for further malicious activity within the organization.

GLPI, the free asset and IT management platform, is affected from release 0.85 up to but not including 10.0.23. All installations of GLPI in this version range are vulnerable.

The CVSS v3.1 score of 6.5 indicates medium severity. Because the exploitation requires authentication, the attack surface is limited to users who can log in to the GLPI instance. The EPSS score is less than 1 %, implying a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need valid credentials and possibly access to the application’s source to craft the malicious input.