CVE-2026-22247
📋 TL;DR
GLPI administrators can exploit a Server-Side Request Forgery (SSRF) vulnerability through the Webhook feature, allowing them to make unauthorized requests to internal systems. This affects GLPI versions 11.0.0 through 11.0.4. The vulnerability requires administrator privileges to exploit.
💻 Affected Systems
- GLPI
📦 What is this software?
Glpi by Glpi Project
⚠️ Risk & Real-World Impact
Worst Case
Administrator could access internal services, exfiltrate sensitive data, or pivot to other systems if internal network access is possible.
Likely Case
Administrator could probe internal network services, potentially discovering other vulnerable systems or accessing internal-only resources.
If Mitigated
Limited impact if proper network segmentation and access controls prevent internal service access from the GLPI server.
🎯 Exploit Status
Exploitation requires administrator credentials and access to the webhook configuration interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.0.5
Vendor Advisory: https://github.com/glpi-project/glpi/security/advisories/GHSA-f6f6-v3qr-9p5x
Restart Required: No
Instructions:
1. Backup your GLPI installation and database. 2. Download GLPI 11.0.5 from the official releases. 3. Replace existing files with new version. 4. Run the update script via web interface or CLI.
🔧 Temporary Workarounds
Disable Webhook Feature
allRemove or restrict access to the webhook functionality in GLPI
# Edit GLPI configuration or remove webhook menu permissions for admin users
Restrict Admin Access
allLimit administrator accounts to trusted users only and implement MFA
# Review and reduce admin user count
# Implement multi-factor authentication
🧯 If You Can't Patch
- Implement strict network segmentation to isolate GLPI server from internal services
- Monitor and audit webhook configuration changes and unusual outbound requests from GLPI server
🔍 How to Verify
Check if Vulnerable:
Check GLPI version in Administration > General > Information, or run: php glpi/inc/glpi_version.phpCheck Version:
php glpi/inc/glpi_version.phpVerify Fix Applied:
Verify version is 11.0.5 or higher, and test webhook functionality with internal URLs to confirm restrictions📡 Detection & Monitoring
Log Indicators:
- Unusual webhook configuration changes
- Outbound HTTP requests from GLPI to internal IP ranges
Network Indicators:
- GLPI server making unexpected HTTP requests to internal services
SIEM Query:
source="glpi.log" AND ("webhook" OR "configuration change") AND admin_user