What is the CVSS score of CVE-2026-25936?

CVE-2026-25936 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Glpi are affected by CVE-2026-25936?

Organizations using version 11.0.0 and should be aware of notable risk from CVE-2026-25936, a SQL injection vulnerability rated CVSS 6.5.. A patch is available.

How to fix or mitigate CVE-2026-25936?

Within 30 days: Identify affected systems running version 11.0.0 and and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Glpi CVE-2026-25936

EUVD-2026-12627 MEDIUM

SQL Injection (CWE-89)

2026-03-17 GitHub_M

SQLi Glpi Glpi Project

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

11.0.6

EUVD ID Assigned

Mar 17, 2026 - 20:30 euvd

EUVD-2026-12627

Analysis Generated

Mar 17, 2026 - 20:30 vuln.today

CVE Published

Mar 17, 2026 - 19:41 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can perfom a SQL injection. Version 11.0.6 fixes the issue.

AnalysisAI

GLPI versions 11.0.0 through 11.0.5 contain an authenticated SQL injection vulnerability that allows authenticated users to read sensitive database contents without modification or denial-of-service capabilities. The vulnerability affects the free Asset and IT management software package GLPI and is resolved in version 11.0.6. While the CVSS score of 6.5 reflects moderate severity, the impact is limited to confidentiality breach due to the read-only nature of the exploit and the requirement for prior authentication.

Technical ContextAI

The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection flaw where user-controlled input is improperly sanitized before being incorporated into SQL queries. GLPI (cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*) is a web-based IT asset management platform written in PHP that manages inventory, helpdesk, and IT operations. The SQL injection occurs in a code path accessible to authenticated users, meaning the vulnerability exists within GLPI's internal query construction logic—likely in a search, filter, or reporting feature—where parameterized queries or prepared statements were not properly implemented or where user input from authenticated sessions bypassed normal validation routines.

RemediationAI

Immediately upgrade GLPI to version 11.0.6 or later by following the vendor's official upgrade documentation at https://github.com/glpi-project/glpi/security/advisories/GHSA-qw3x-7vv2-7759. Prior to patching, implement defense-in-depth measures including network segmentation to restrict GLPI access to trusted internal networks only, enforce strong authentication policies and multi-factor authentication to limit compromised account impact, monitor database query logs for suspicious SQL patterns or unusual data access by user accounts, and consider temporarily disabling or restricting advanced search and reporting features if they are the attack vector. Review user access controls and revoke unnecessary database privileges from the GLPI application user account at the database level.