glpi
Configuration ManagementGLPI is a free open‑source IT asset and service management platform that implements ITIL processes such as request fulfillment, incident tracking, change control, knowledge base, contract and financial management.
Features
- Service Asset & Configuration Management (dynamic inventory)
- ITIL‑compliant Request Fulfillment, Incident & Problem Management
- Change Management with controlled rollout workflows
- Knowledge Base and FAQ support for self‑service resolutions
- Contract, financial and license management for IT services
Recent releases
View all 8 releases →
11.0.7
Security relevant
Security fixes
- Unauthorized update of configuration
- Unauthorized IMAP connection probing
- Unauthorized reading of a specific asset object
Full changelog
This is a security release, upgrading is recommended
You will find below the list of security issues fixed in this bugfixes version:
- [SECURITY - Low] Unauthorized update of configuration
- [SECURITY - Low] Unauthorized IMAP connection probing
- [SECURITY - Low] Unauthorized reading of a specific asset object
- [SECURITY - Low] Unauthorized modification of webhook payload templates
- [SECURITY - Low] Unauthorized Webhook CRA Validation SSRF
- [SECURITY - Low] Webhook CRA signature bypass
- [SECURITY - Low] Unauthorized resending of queued webhooks
- [SECURITY - Medium] Unauthorized export of form structure (CVE-2026-32312)
- [SECURITY - Medium] Arbitrary files access (CVE-2026-42320)
- [SECURITY - High] Stored XSS in knowledge base (CVE-2026-5385)
- [SECURITY - High] Stored XSS in ITIL Costs (CVE-2026-40108)
- [SECURITY - High] Arbitrary item deletion via planning (CVE-2026-42318)
- [SECURITY - High] Arbitrary files deletion by technician (CVE-2026-42317)
The full changelog is available for more details.
We would like to thank all people who contributed to this new version and all those who contributes regularly to the GLPI project!
Regards.
10.0.25
Security relevant
Security fixes
- Unauthorized update of configuration
- Unauthorized IMAP connection probing
- Arbitrary files access (CVE-2026-42320)
Full changelog
This is a security release, upgrading is recommended
This release fixes a few security issues that have been recently discovered. Update is recommended!
You will find below the list of security issues fixed in this bugfixes version:
- [SECURITY - Low] Unauthorized update of configuration
- [SECURITY - Low] Unauthorized IMAP connection probing
- [SECURITY - Medium] Arbitrary files access (CVE-2026-42320)
- [SECURITY - High] Stored XSS in asset locks (CVE-2026-42321)
- [SECURITY - High] Stored XSS in knowledge base (CVE-2026-5385)
- [SECURITY - High] Arbitrary item deletion via planning (CVE-2026-42318)
- [SECURITY - High] Arbitrary files deletion by technician (CVE-2026-42317)
Many bug fixes have also been made, read the full changelog is available for more details.
We would like to thank all people who contributed to this new version and all those who contributes regularly to the GLPI project!
Regards.
11.0.6
Security relevant
Security fixes
- Server-Side Template Injection (CVE-2026-26026)
- Stored XSS via Inventory (CVE-2026-26027)
- Unauthenticated SQL Injection via Search engine (CVE-2026-26263)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
