GLPI versions 11.0.0 through 11.0.5 contain an unauthenticated, time‑based blind SQL injection in the search engine. The flaw allows an attacker to craft SQL queries that cause delays based on query results, enabling extraction of database contents without authentication. This vulnerability can lead to disclosure of sensitive asset and IT management data, compromising confidentiality of the system.

The vulnerability affects installations of GLPI from the glpi‑project, specifically all releases from version 11.0.0 up to, but not including, 11.0.6. Any other version is not impacted.

The CVSS score of 8.1 identifies the issue as high severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, so no confirmed exploitation is known. The attack can be performed over the network via the search engine endpoint without authentication, making it accessible to external adversaries. Without a patch, an attacker could use the time‑based responses to enumerate database tables and columns, potentially revealing confidential information.