CVE-2026-53629 in GLPI

Resumen

por MITRE • 2026-09-25

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Responsable: GitHub M
• Reservar: 2026-06-09
• Divulgación: 2026-09-25
• Moderación: aceptado
• Artículo: VDB-410430
• CPE: listo
• CWE: CWE-89 (confirmado)
• CVSS: 6.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Actividades: muy bajo
• Sector: Lawfirm, Government, ...

Fuentes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-53629
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-53629
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-53629/