CVE-2025-24801

HIGH

Glpi < 10.0.18 - Unrestricted File Upload

Title source: rule

Description

GLPI is a free asset and IT management software package. An authenticated user can upload and force the execution of *.php files located on the GLPI server. This vulnerability is fixed in 10.0.18.

Exploits (2)

nomisec WORKING POC 3 stars

by fatkz · poc

https://github.com/fatkz/CVE-2025-24801

View Code ZIP pw:eip

nomisec WORKING POC

by r1beirin · poc

https://github.com/r1beirin/Exploit-CVE-2025-24801

View Code ZIP pw:eip

References (1)

[Vendor Advisory] https://github.com/glpi-project/glpi/security/advisories/GHSA-g2p3-33ff-r555

Scores

CVSS v3 8.5

EPSS 0.0298

EPSS Percentile 86.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-434

Status published

Products (1)

glpi-project/glpi 0.85 - 10.0.18

Published Mar 18, 2025

Tracked Since Feb 18, 2026