GLPI versions 11.0.0 through 11.0.4 allow an administrator to configure a webhook that can send requests to any network address. This server‑side request forgery (CWE‑918) could enable the attacker to make internal API calls, harvest sensitive data, or use the compromised instance as a pivot to other systems. The impact is limited to the privileges of the GLPI administrator and the network reachability of the target system, but it can still lead to confidentiality or integrity violations if internal endpoints are accessed.

The vulnerability exists in the GLPI project’s software for the specified version range. Administrators running GLPI 11.0.0 up to 11.0.4 are affected; versions 11.0.5 and newer have the fix applied.

The CVSS score of 4.1 classifies the issue as low severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. GLPI is not listed in the CISA KEV catalog. Successful exploitation requires administrative access to the GLPI instance and the ability to create or modify webhook configurations, making the attack vector relatively constrained to authenticated users with elevated privileges.