PT-2025-51790 · Glpi+2 · Glpi+2

Published 2025-12-16 · Updated 2026-03-19 · CVE-2025-64520

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions 9.1.0 through 10.0.20

Description An unauthorized user with API access can read all knowledge base entries. The issue affects GLPI versions 9.1.0 and prior to 10.0.21. The affected API allows unauthorized access to knowledge base data.

Recommendations Upgrade to version 10.0.21 to receive a patch.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-05594

CVE-2025-64520

GHSA-62P9-PRPQ-J62Q

Affected Products

Alt Linux

Glpi

Red Os

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64520.json · Exploit
• https://github.com/glpi-project/glpi/commit/a3d5cc4a63ae592c0b5592ebe6d562164904dab3 · Patch
• https://github.com/glpi-project/glpi/security/advisories/GHSA-62p9-prpq-j62q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64520 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-64520 · Security Note
• https://ubuntu.com/security/CVE-2025-64520 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-64520 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64520 · Security Note
• https://bdu.fstec.ru/vul/2026-05594 · Security Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-glpi-cve-2025-64520-7.3 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-glpi-cve-2025-64520-8.0 · Note
• https://redos.red-soft.ru/search/?iblock_id=24&q=CVE-2025-64520 · Note
• https://twitter.com/autumn_good_35/status/2001358763606052918 · Twitter Post
• https://twitter.com/CVEnew/status/2001350859423441386 · Twitter Post
• https://t.me/CVEtracker/40012 · Telegram Post