What is the CVSS score of CVE-2026-29047?

CVE-2026-29047 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Glpi are affected by CVE-2026-29047?

GLPI asset management software contains a SQL injection vulnerability affecting versions 10.0.0-10.0.23 and 11.0.0-11.0.5 that allows authenticated administrators to execute arbitrary database…. A patch is available.

How to fix or mitigate CVE-2026-29047?

Within 24 hours: Inventory all GLPI deployments and identify instances running versions 10.0.0-10.0.23 or 11.0.0-11.0.5. Within 7 days: Apply vendor-released patch to upgrade affected instances to patched versions (10.0.24+ or 11.0.6+). Within 30 days: Audit administrative user accounts and access logs for the logs export feature to detect unauthorized activity; implement role-based access controls limiting export functionality to essential administrators only.

Glpi CVE-2026-29047

EUVD-2026-19249 HIGH

SQL Injection (CWE-89)

2026-04-06 security-advisories@github.com

SQLi Glpi Glpi Project

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:06 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

11.0.6

EUVD ID Assigned

Apr 06, 2026 - 15:22 euvd

EUVD-2026-19249

Analysis Generated

Apr 06, 2026 - 15:22 vuln.today

CVE Published

Apr 06, 2026 - 15:17 nvd

HIGH 7.2

DescriptionGitHub Advisory

GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, an authenticated user can perform a SQL injection via the logs export feature. This vulnerability is fixed in 10.0.24 and 11.0.6.

AnalysisAI

SQL injection in GLPI asset management software versions 10.0.0 through 10.0.23 and 11.0.0 through 11.0.5 allows authenticated administrators to execute arbitrary SQL commands through the logs export feature. The vulnerability requires high-level privileges (PR:H), limiting the attack surface to compromised admin accounts or malicious insiders. No public exploit identified at time of analysis. CVSS 7.2 reflects the high impact but limited attacker base, while the network attack vector (AV:N) means exploitation requires only network access to the GLPI instance.

Technical ContextAI

GLPI (Gestionnaire Libre de Parc Informatique) is an open-source IT asset management and helpdesk solution. This vulnerability stems from CWE-89 (SQL Injection), indicating improper neutralization of SQL commands in the logs export functionality. The flaw allows user-controlled input to be passed to database queries without adequate sanitization or parameterization. Given the administrative privilege requirement, the vulnerable code likely exists in backend log management features accessible only to high-privilege users. SQL injection in logging features commonly occurs when constructing dynamic queries for filtering, sorting, or formatting log data during export operations. The affected versions span two major release branches (10.0.x and 11.0.x), suggesting the vulnerable code existed across a significant period of development.

RemediationAI

Upgrade to GLPI version 10.0.24 or 11.0.6, which contain fixes for this SQL injection vulnerability. Organizations running the 10.0.x branch should upgrade to 10.0.24, while those on 11.0.x should upgrade to 11.0.6. Patched versions are confirmed available per vendor advisory GHSA-3m49-qf92-vccr at https://github.com/glpi-project/glpi/security/advisories/GHSA-3m49-qf92-vccr. As an interim mitigation for environments unable to patch immediately, restrict administrative access to the logs export feature through role-based access controls, implement network segmentation to limit who can reach the GLPI administrative interface, and enable comprehensive audit logging to detect suspicious database queries or unusual log export activity. Review and rotate credentials for all administrative accounts as a precautionary measure.