GLPI is a widely used asset and IT management platform that suffered a Server‑Side Template Injection vulnerability in templating logic, allowing an authenticated administrator to craft input that is compiled twice by the template engine. The double‑compilation flaw makes it possible to inject arbitrary code, effectively bypassing the web application’s input filtering. This injection is aligned with the Common Weakness Enumeration categories for code injection and template injection.

The vulnerability exists in GLPI versions between 11.0.0 and just before 11.0.6, inclusive. Users running any of those releases are at risk until the upstream developers push the fix delivered in the 11.0.6 release. The impact is limited to systems where the GLPI installation is accessible to administrators, as an attacker must authenticate with administrative rights to trigger the template injection. The software is available through the GLPI project website and open‑source repositories, so many corporate and public deployments remain affected.

The flaw received a CVSS score of 9.1, indicating a high severity, yet the EPSS probability is reported as less than 1%, suggesting that exploitation is unlikely in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, further indicating that it has not yet been widely abused by attackers. That said, if an attacker gains admin credentials or otherwise compromises an administrator’s session, the attack vector becomes a straightforward web‑based exploitation and can provide full control of the underlying server.