Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.8
CVE-2025-21626: GLPI status page reveals private data to anyone
CVE-2025-21626 · published 1 year ago
Summary
The GLPI management system (versions 0.71 up to before 10.0.18) lets anyone view the status.php page and see internal details such as server names and LDAP settings. This can give outsiders information they could use for further attacks. Upgrade to version 10.0.18 or later, or block access to status.php and remove sensitive entries from configuration fields.
What to do
- Update glpi-project glpi to version 10.0.18 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| glpi-project | glpi |
>= 0.71, < 10.0.18 cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:* |
Original advisory text
GLPI vulnerable to exposure of sensitive information in the `status.php` endpoint
GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the `status.php` endpoint. Version 10.0.18 contains a fix for the issue. Some workarounds are available. One may delete the `status.php` file, restrict its access, or remove any sensitive values from the `name` field of the active LDAP directories, mail servers authentication providers and mail receivers.
References
- https://github.com/glpi-project/glpi/releases/tag/10.0.18 URL
- https://github.com/glpi-project/glpi/security/advisories/GHSA-5vvr-pxwf-3w77 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21626... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-21626 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
5.8
Medium
Type
CWE-200Information Exposure
Timeline
Published25 Feb 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta