PT-2025-12806 · Glpi+1 · Glpi Inventory Plugin+1

Published 2025-03-25 · Updated 2025-04-03 · CVE-2025-27147

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions GLPI Inventory Plugin versions prior to 1.5.0

Description The GLPI Inventory Plugin handles various tasks for GLPI agents, including network discovery and inventory, software deployment, and data collection. It has an improper access control issue.

Recommendations For versions prior to 1.5.0, update to version 1.5.0 to fix the vulnerability.

Exploit

Fix

RCE

Path traversal

Files Accessible to External Parties

Weakness Enumeration

CWE-73

CWE-22

CWE-552

Related Identifiers

BDU:2025-07590

CVE-2025-27147

GHSA-H6X9-JM98-CW7C

Affected Products

Glpi Inventory Plugin

Red Os

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27147.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-27147 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27147 · Security Note
• https://bdu.fstec.ru/vul/2025-07590 · Security Note
• https://github.com/glpi-project/glpi-inventory-plugin/commit/aaeb26d98d07019375c25b56e60fffc195553545 · Note
• https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-h6x9-jm98-cw7c · Note
• https://t.me/latest_high_impact_cve/2048 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-glpi-plugin-glpiinventory-cve-2025-27147 · Note
• https://t.me/cvetracker/19891 · Telegram Post
• https://twitter.com/cybercronai/status/1904972307963011524 · Twitter Post
• https://twitter.com/CVEnew/status/1904546909164867683 · Twitter Post
• https://t.me/cvedetector/21106 · Telegram Post
• https://twitter.com/cybercronai/status/1904575365055381540 · Twitter Post