CVE-2026-53629 in GLPI
Summary
by MITRE • 09/25/2026
GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
GLPI, widely recognized as an open-source IT asset management solution, facilitates the tracking of hardware, software, and network infrastructure within enterprise environments. The vulnerability identified affects GLPI versions ranging from 9.4.0 through 10.0.25 and up to version 11.0.8. This specific flaw resides in the application's history tab functionality, which is designed to display logs of user actions and system events for auditing purposes. While the vulnerability requires an attacker to possess at least READ permissions on log data, this privilege level is often granted to a broad range of users within IT departments, thereby expanding the potential attack surface significantly compared to vulnerabilities requiring administrative access.
The core technical flaw involves improper neutralization of special elements used in SQL commands, commonly categorized under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Specifically, when constructing URLs for the history tab endpoint, GLPI fails to adequately sanitize or parameterize user-supplied input before incorporating it into database queries. This allows a malicious actor to inject crafted URL parameters that alter the structure of the underlying SQL statement executed by the backend database server. By manipulating these query parameters, an attacker can bypass intended logic and execute arbitrary SQL commands against the application's database.
The operational impact of this SQL injection vulnerability is severe due to the nature of IT management software which typically stores sensitive configuration data, user credentials, asset details, and potentially personally identifiable information in its central repository. Successful exploitation could allow an authenticated but low-privilege user to extract unauthorized data from the database, modify existing records, or even execute commands on the underlying operating system depending on the database engine's capabilities and privileges granted to the application's database account. This represents a significant breach of confidentiality and integrity within the IT management infrastructure, potentially exposing critical organizational assets and operational logs to malicious actors who have gained basic read access to log files.
This vulnerability aligns with MITRE ATT&CK technique T1059: Command and Scripting Interpreter if used for further exploitation or data exfiltration via out-of-band channels, but primarily falls under the category of injection attacks that compromise database integrity. The lack of proper input validation in dynamic query construction is a classic example of how insufficient sanitization leads to security breaches. Organizations running affected versions must prioritize immediate remediation by upgrading GLPI to version 10.0.26 or later for the stable branch, or version 11.0.8 and above for the development branch where this issue has been resolved. Until patches are applied, administrators should enforce strict access controls on log viewing capabilities, limiting READ permissions only to essential personnel who require such access for operational auditing, thereby reducing the number of potential attackers capable of crafting malicious URLs against the history tab endpoint.