GLPI CVE-2026-29047

Requires an authenticated GLPI session with a valid account (CVSS PR:L - low privilege is sufficient; no admin role is stated as required) and access to the logs export feature, which is the specific component through which the SQL injection is reached. Affected deployments are GLPI 10.0.0 through before 10.0.24 and the 11.0.x branch (including 11.0.0-alpha) before 11.0.6. The primary limiting factor is the authentication requirement: unauthenticated remote attackers cannot trigger this, so realistic risk concentrates on insiders or attackers with stolen/obtained credentials. No user interaction and no special non-default configuration is indicated by the advisory; the exact injectable parameter within the export feature is not described in the available sources. The only complete fix stated by the vendor is upgrading to 10.0.24 or 11.0.6.

Signals here are consistent and point to a genuine but non-emergency priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8) describes a network-reachable, low-complexity attack that requires only low-privilege authentication and no user interaction, yielding total compromise of the GLPI database (classic CWE-89 SQL injection). The SSVC framework agrees on severity (Technical Impact: total) but tempers urgency: Exploitation is 'none' (no observed or public exploitation) and Automatable is 'no', indicating this is not a mass-scannable, worm-able flaw. The EPSS score is very low (0.03%, 8th percentile), reinforcing that widespread exploitation is not currently expected. There is no CISA KEV listing and no public exploit code identified. The one tension worth noting: the high CVSS and 'total' technical impact could overstate day-one urgency, but the vuln.today decision label is 'this_week' rather than act_now/emergency, which aligns with the low EPSS and 'none' exploitation status. Net: a real, high-impact authenticated SQLi that should be patched promptly on the scheduled cycle, but it is not an actively-exploited internet-wide emergency. The chief limiting factor is the authentication requirement (PR:L) - any valid GLPI account, even a low-privilege one, is sufficient, so the realistic threat is primarily from authenticated insiders or attackers who have already obtained valid credentials.

An attacker who holds any valid low-privilege GLPI account (10.0.0 up to before 10.0.24, or 11.0.x before 11.0.6) navigates to the logs export feature and submits crafted input that is injected into a backend SQL query. Because the injection grants full read/write impact on the database (C:H/I:H/A:H), the attacker can exfiltrate or tamper with asset, credential, and configuration data stored by GLPI. No public exploit code is identified at time of analysis, and exploitation requires authentication and no user interaction.