CVE-2022-39376 in GLPI
Summary
by MITRE • 11/03/2022
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to inject custom fields values in `mailto` links. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 06/30/2026
The vulnerability identified as CVE-2022-39376 affects GLPI version 10.0.3 and earlier, representing a significant security flaw in the widely used IT asset management software. GLPI serves as a comprehensive platform for ITIL service desk operations, license tracking, and software auditing, making it a critical component in enterprise IT infrastructure management. This vulnerability specifically resides in how the application handles custom field values within mailto links, creating an avenue for potential injection attacks that could compromise the integrity of communication flows within the system.
The technical flaw manifests when user-controlled data from custom fields is improperly sanitized before being incorporated into mailto URI schemes. This injection vulnerability allows attackers to manipulate the constructed mailto links by injecting malicious parameters or payloads that could redirect users to unintended destinations or execute unwanted actions. The vulnerability falls under CWE-74, which describes improper neutralization of special elements in output used by a downstream component, specifically within the context of URI schemes. The flaw represents a classic input validation issue where user-supplied data is not adequately filtered or escaped before being embedded in system-generated links.
The operational impact of this vulnerability extends beyond simple data manipulation, potentially enabling attackers to conduct phishing attacks or redirect users to malicious websites through crafted mailto links. When users interact with these compromised links, they may unknowingly be directed to harmful domains or have their credentials exposed through crafted email templates. The vulnerability affects the core functionality of GLPI's communication features, which are fundamental to IT service desk operations, potentially compromising the security of sensitive information exchanges between IT staff and end users. This represents a medium to high severity risk given GLPI's widespread adoption in enterprise environments where IT asset management and service desk operations are critical.
Organizations utilizing GLPI should immediately upgrade to version 10.0.4 or later to remediate this vulnerability, as no effective workarounds exist for this particular flaw. The patch addresses the root cause by implementing proper input sanitization and validation for custom field values before they are processed into mailto links. Security teams should also conduct thorough audits of existing GLPI installations to ensure all instances are updated and monitor for potential exploitation attempts. This vulnerability aligns with ATT&CK technique T1566.001, which covers phishing through social engineering, as the compromised mailto links could be used to craft convincing phishing campaigns targeting GLPI users. The incident underscores the importance of maintaining up-to-date software versions and implementing robust input validation mechanisms in web applications that handle user-generated content.