CVE-2025-24801

HIGH

Glpi < 10.0.18 - Unrestricted File Upload

Title source: rule

Description

GLPI is a free asset and IT management software package. An authenticated user can upload and force the execution of *.php files located on the GLPI server. This vulnerability is fixed in 10.0.18.

Exploits (2)

nomisec WORKING POC 3 stars

by fatkz · poc

https://github.com/fatkz/CVE-2025-24801

View Code ZIP pw:eip

nomisec WORKING POC

by r1beirin · poc

https://github.com/r1beirin/Exploit-CVE-2025-24801

View Code ZIP pw:eip

References (1)

[Vendor Advisory] https://github.com/glpi-project/glpi/security/advisories/GHSA-g2p3-33ff-r555

Scores

CVSS v3 8.5

EPSS 0.0019

EPSS Percentile 40.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Classification

CWE

CWE-434

Status published

Affected Products (1)

glpi-project/glpi < 10.0.18

Timeline

Published Mar 18, 2025

Tracked Since Feb 18, 2026