GLPI, a free asset and IT management software package, contains an unauthenticated time‑based blind SQL injection in its search engine for versions 11.0.0 through 11.0.5. The flaw, governed by CWE‑89, allows any unauthenticated visitor to craft a search query that is directly incorporated into an SQL statement, causing the database to execute injected logic and potentially expose arbitrary data. Exfiltration of sensitive asset, user, and configuration information compromises confidentiality and may enable further attacks.

The vulnerability affects GLPI versions 11.0.0 to 11.0.5, inclusive. No other editions or vendors have affected product besides the GLPI project package available from the official website.

The CVSS v3 score of 8.1 signals high severity. An EPSS score of 8% indicates that exploitation is more probable than many other publicly known vulnerabilities, although still uncommon. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploits reported. The attack requires only unauthenticated access to the public search interface, with no special permissions; the risk remains high and the likelihood of exploitation is moderate, especially for exposed instances.