UpHeron
All vulnerabilities

Servers and applications

CVE-2025-53113

Access to unallowed items information through external links

Severity
Low 2.7
Published
29 Jul 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.0.19
Also known as
GHSA-r2mm-6499-4m8j
Sources
NVD, Project advisories (GitHub)

Description

GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.65 through 10.0.18, a technician can use the external links feature to fetch information on items they do not have the right to see. This is fixed in version 10.0.19.

Affected software

SoftwareAffected versions
GLPIServers and applications · cpe:a:glpi-project:glpi
  • From 0.65 before 10.0.19
GLPIServers and applications · github:glpi-project/glpi
  • From 0.65 before 10.0.19

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-53113
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-53113
  • GitHub Advisory Database https://github.com/advisories/GHSA-r2mm-6499-4m8j
  • github.com https://github.com/glpi-project/glpi/security/advisories/GHSA-r2mm-6499-4m8j