PT-2026-3058 · Glpi+1 · Glpi+1

Published 2026-01-15 · Updated 2026-03-19 · CVE-2025-64516

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 10.0.21 GLPI versions prior to 11.0.3

Description An unauthorized user can access GLPI documents attached to any item, such as tickets or assets. If the public FAQ is enabled, this unauthorized access can be performed by an anonymous user.

Recommendations Update to version 10.0.21 or later. Update to version 11.0.3 or later.

Exploit

Fix

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

BDU:2026-05593

CVE-2025-64516

GHSA-487H-7MXM-7R46

Affected Products

Glpi

Red Os

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64516.json · Exploit
• https://github.com/glpi-project/glpi/security/advisories/GHSA-487h-7mxm-7r46 · Vendor Advisory
• https://github.com/glpi-project/glpi/commit/51412a89d3174cfe22967b051d527febdbceab3c · Patch
• https://github.com/glpi-project/glpi/commit/ee7ee28e0645198311c0a9e0c4e4b712b8788e27 · Patch
• https://osv.dev/vulnerability/CVE-2025-64516 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-64516 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-64516 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-64516 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05593 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-64516 · Security Note
• https://github.com/glpi-project/glpi/releases/tag/11.0.3 · Note
• https://github.com/glpi-project/glpi/releases/tag/10.0.21 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-glpi-cve-2025-64516-7.3 · Note
• https://twitter.com/autumn_good_35/status/2012166080576315481 · Twitter Post
• https://redos.red-soft.ru/search/?iblock_id=24&q=CVE-2025-64516 · Note