CVE-2025-52897
📋 TL;DR
GLPI versions 9.1.0 through 10.0.18 contain a vulnerability in the planning feature that allows unauthenticated attackers to craft malicious links for phishing attacks. This affects all GLPI instances running vulnerable versions, potentially exposing users to credential theft or malware installation.
💻 Affected Systems
- GLPI
📦 What is this software?
Glpi by Glpi Project
⚠️ Risk & Real-World Impact
Worst Case
Users click malicious links leading to credential harvesting, malware installation, or further compromise of internal systems through social engineering.
Likely Case
Phishing campaigns targeting GLPI users to steal credentials or deliver malware via seemingly legitimate planning links.
If Mitigated
Users trained to recognize phishing attempts prevent successful exploitation despite vulnerable software.
🎯 Exploit Status
Exploitation requires user interaction (clicking link) but is trivial for attackers to craft malicious URLs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.19
Vendor Advisory: https://github.com/glpi-project/glpi/security/advisories/GHSA-6whm-q2rp-prqm
Restart Required: No
Instructions:
1. Backup GLPI database and files. 2. Download GLPI 10.0.19 or later. 3. Follow official upgrade documentation. 4. Verify planning feature functionality post-upgrade.
🔧 Temporary Workarounds
Disable Planning Feature
allTemporarily disable the planning feature to prevent exploitation.
UPDATE glpi_configs SET value = '0' WHERE name = 'use_planning';
🧯 If You Can't Patch
- Implement web application firewall rules to block suspicious planning URLs
- Deploy email security controls to filter phishing attempts targeting GLPI users
🔍 How to Verify
Check if Vulnerable:
Check GLPI version in Administration > General > Information. If version is between 9.1.0 and 10.0.18 inclusive, system is vulnerable.Check Version:
SELECT value FROM glpi_configs WHERE name = 'version';Verify Fix Applied:
Confirm version is 10.0.19 or later and test planning feature with legitimate URLs.📡 Detection & Monitoring
Log Indicators:
- Unusual planning URL patterns in GLPI logs
- Multiple failed authentication attempts following planning link access
Network Indicators:
- Outbound connections to suspicious domains after planning feature access
SIEM Query:
source="glpi" AND (url="*planning*" AND url="*http://*" OR url="*https://*")