CVE-2025-21626

GLPI is an asset/IT management product vulnerable up to version 10.0.18 due to an anonymous user able to fetch sensitive data from status.php. The issue is fixed in 10.0.18; mitigations include deleting status.php, restricting access, or sanitizing sensitive values in LDAP directories and related...

CVE-2025-21626 GLPI vulnerable to exposure of sensitive information in the `status.php` endpoint

GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the status.php endpoint. Version 10.0.18 contains a fix for the issue. Some workarounds are available. One may delete the status.p...