CVE-2026-22044
📋 TL;DR
This vulnerability allows authenticated users in GLPI (an IT management software) to perform SQL injection attacks. It affects all GLPI installations running versions 0.85 through 10.0.22. Attackers could potentially access, modify, or delete database information.
💻 Affected Systems
- GLPI
📦 What is this software?
Glpi by Glpi Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, or system takeover
Likely Case
Unauthorized data access and potential data manipulation
If Mitigated
Limited impact due to proper input validation and database permissions
🎯 Exploit Status
Requires authenticated access but SQL injection is typically straightforward to exploit
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.23
Vendor Advisory: https://github.com/glpi-project/glpi/security/advisories/GHSA-569q-j526-w385
Restart Required: No
Instructions:
1. Backup your GLPI installation and database. 2. Download version 10.0.23 from the official repository. 3. Follow the GLPI upgrade documentation for your specific deployment method.
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement additional input validation for user-controlled parameters
Database Permission Restriction
allLimit database user permissions to minimum required operations
🧯 If You Can't Patch
- Implement web application firewall (WAF) with SQL injection rules
- Restrict authenticated user access to only trusted personnel
🔍 How to Verify
Check if Vulnerable:
Check GLPI version in Administration > General > InformationCheck Version:
Check GLPI web interface or examine GLPI configuration filesVerify Fix Applied:
Verify version is 10.0.23 or higher in Administration > General > Information📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed login attempts followed by SQL-like patterns
Network Indicators:
- Unusual database connection patterns from application servers
SIEM Query:
source="glpi_logs" AND ("sql" OR "query" OR "select" OR "insert" OR "update" OR "delete") AND NOT source="normal_operations"