CVE-2025-24801

🗓️ 18 Mar 2025 18:32:06Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 172 Views🌐 WEB

Vulnerability in GLPI allows file upload and execution by authenticated users; fixed in version 10.0.18.

Reporter	Title	Published	Views	Family All 47
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Glpi-Project Glpi	19 Apr 202501:59	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Glpi-Project Glpi	2 Oct 202612:08	–	githubexploit
GithubExploit	Exploit for SQL Injection in Glpi-Project Glpi	6 Sep 202600:38	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Glpi-Project Glpi	5 May 202523:22	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Glpi-Project Glpi	2 Oct 202612:08	–	githubexploit
BDU FSTEC	The vulnerability of the Inventory module in the GLPI system, which handles requests, incidents, and inventory management of computer equipment, allows a perpetrator to execute arbitrary codes.	24 Mar 202500:00	–	bdu_fstec
FreeBSD	glpi-project -- GLPI multiple vulnerabilities	25 Feb 202500:00	–	freebsd
Circl	CVE-2025-24801	12 Mar 202510:58	–	circl
CNNVD	GLPI 代码问题漏洞	18 Mar 202500:00	–	cnnvd
Cvelist	CVE-2025-24801 GLPI allows authenticated remote code execution	18 Mar 202518:32	–	cvelist

NVD

Vulners

Node

glpi-project glpiRange0.85–10.0.18

[
  {
    "vendor": "glpi-project",
    "product": "glpi",
    "versions": [
      {
        "version": ">= 0.85, < 10.0.18",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/glpi-project/glpi/security/advisories/GHSA-g2p3-33ff-r555

Parameter	Position	Path	Description	CWE
ext	request body	/front/documenttype.form.php?id=1	Enable PHP extension in Document Types to allow PHP payload upload (ext parameter controls allowed extensions).	CWE-434
_uploader_filename[]	upload data	/ajax/fileupload.php	Upload PHP payload via ticket document widget to GLPI_TMP_DIR.	CWE-434
pdffont	request body	/front/config.form.php	Set global pdffont to the uploaded payload path (without .php) to trigger LFI.	CWE-434
pdffont	request body	/front/preference.php	Set user pdffont (glpi_users) to the payload path to ensure user-level value overrides global.	CWE-434
cmd	query param	/front/report.dynamic.php	Trigger LFI by passing cmd to export a PDF; TCPDF includes the pdffont file, leading to code execution.	CWE-434
user	request body	/front/login.php	Authenticate as an admin to perform exploitation steps.	CWE-434
pass	request body	/front/login.php	Authenticate as an admin to perform exploitation steps.	CWE-434

17 Jun 2026 08:59Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.18.5 - 8.8

EPSS0.20986

SSVC

CWE-434