High severity · published Jan 15, 2026
CVE-2025-64516
GLPI incorrectly authorizes access to documents
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset, ...). If the public FAQ is enabled, this unauthorized access can be performed by an anonymous user. This vulnerability is fixed in 10.0.21 and 11.0.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
glpi · glpi-project
>= 10.0.0, < 10.0.21; >= 11.0.0, < 11.0.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-64516
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-64516
Patch
https://github.com/glpi-project/glpi/commit/51412a89d3174cfe22967b051d527febdbceab3c
Patch
https://github.com/glpi-project/glpi/commit/ee7ee28e0645198311c0a9e0c4e4b712b8788e27
Release Notes
https://github.com/glpi-project/glpi/releases/tag/10.0.21
Release Notes
https://github.com/glpi-project/glpi/releases/tag/11.0.3
Vendor Advisory
https://github.com/glpi-project/glpi/security/advisories/GHSA-487h-7mxm-7r46
More from glpi
9.8
CVE-2022-35914
Teclib GLPI Remote Code Execution Vulnerability
9.8
CVE-2026-26263
GLPI has an Unauthenticated SQL Injection via Search engine
9.8
CVE-2025-66417
GLPI has an unauthenticated SQL injection through the inventory endpoint
9.8
CVE-2025-24799
GLPI allows unauthenticated SQL injection through the inventory endpoint
9.8
CVE-2025-21619
GLPI allows SQL injection through the rules configuration