CVE-2025-52897 - GLPI is vulnerable to XSS and open redirection attacks through planning feature

Back Back to CVE browser

MEDIUM

GLPI is vulnerable to XSS and open redirection attacks through planning feature

Published Jul 30, 2025

6.5

MEDIUM

CVSS 3.1

EPSS 0.21%

Description

GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19.

Affected products

Vendor Glpi-Project Product Glpi Default
n/a
- Version
  >= 9.1.0, < 10.0.19
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Glpi-Project

Glpi

n/a

Version	Status	Constraints
>= 9.1.0, < 10.0.19	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-601

Open Redirect

CWE-80

References (1)

https://github.com/glpi-project/glpi/security/advisories/GHSA-6whm-q2rp-prqm
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://github.com/glpi-project/glpi/security/advisories/GHSA-6whm-q2rp-prqm		x_refsource_CONFIRMVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitHub_M

Published Jul 30, 2025

Updated Jul 30, 2025

Reserved Jun 20, 2025

Link CVE-2025-52897

CISA Vulnrichment

Updated Jul 30, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-52897

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-52897