GLPI, an open‑source asset and IT management platform, has a flaw in versions 9.4.0 through 10.0.25 and in 11.x prior to 11.0.8. The issue allows an attacker who already has read access to logs to craft a URL for the history tab, resulting in an uncontrolled SQL query. The injection (CWE‑89) can lead to retrieval of sensitive data, corruption of stored information, or database‑level escalation if the database user has sufficient privileges.

Glpi is impacted when running any of the following: versions from 9.4.0 up to 10.0.25, and any 11.x release earlier than 11.0.8. The flaw is fixed in releases 10.0.26 and 11.0.8 and later.

The CVSS score of 7.1 indicates a substantial risk. The EPSS score is 1%, indicating a low but nonzero probability of exploitation; the vulnerability is not listed in the CISA KEV catalog, implying no known widespread attacks. The likely attack vector is an HTTP request to the history tab endpoint; this inference is based on the description that the attacker injects values via a crafted URL. Successful exploitation requires read permission on logs and could result in unauthorized data disclosure or manipulation within the database.