CVE-2025-27147

GLPI Inventory plugin has Improper Access Control Vulnerability

State: Published
Severity: 8.2 High
Published: Mar 25, 2025
Updated: Mar 25, 2025
Reserved: Feb 19, 2025

Description

The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deployment, VMWare ESX host remote inventory, and data collection (files, Windows registry, WMI). Versions prior to 1.5.0 have an improper access control vulnerability. Version 1.5.0 fixes the vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L	GitHub_M

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73 External Control of File Name or Path
CWE-552 Files or Directories Accessible to External Parties

Affected Products

Product	Versions
glpi-inventory-pluginglpi-project	< 1.5.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.