UpHeron
All vulnerabilities

Servers and applications

CVE-2025-52567

Blind SSRF in RSS feeds and planning

Severity
Medium 5.0
Published
29 Jul 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.0.19
Also known as
GHSA-5mp6-mgmh-vrq7
Sources
NVD, Project advisories (GitHub)

Description

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 0.84 through 10.0.18, usage of RSS feeds or external calendars when planning is subject to SSRF exploit. The previous security patches provided since GLPI 10.0.4 were not robust enough for certain specific cases. This is fixed in version 10.0.19.

Affected software

SoftwareAffected versions
GLPIServers and applications · cpe:a:glpi-project:glpi
  • From 0.84 before 10.0.19
GLPIServers and applications · github:glpi-project/glpi
  • From 0.84 before 10.0.19

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-52567
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-52567
  • GitHub Advisory Database https://github.com/advisories/GHSA-5mp6-mgmh-vrq7
  • github.com https://github.com/glpi-project/glpi/security/advisories/GHSA-5mp6-mgmh-vrq7