CVE-2025-21626 GLPI vulnerable to exposure of sensitive information in the `status.php` endpoint

What is CVE-2025-21626?

CVE-2025-21626 is a medium-severity vulnerability in Glpi-Project Glpi, published on 25 Feb 2025.

Official description

GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the `status.php` endpoint. Version 10.0.18 contains a fix for the issue. Some workarounds are available. One may delete the `status.php` file, restrict its access, or remove any sensitive values from the `name` field of the active LDAP directories, mail servers authentication providers and mail receivers.

Weakness: CWE-200

Which versions are affected by CVE-2025-21626?

It affects 1 product.

Products include Glpi-Project Glpi.

How do I fix CVE-2025-21626?

Upgrade to a fixed version.

Is CVE-2025-21626 being exploited?

There is no known exploitation of CVE-2025-21626 in the wild and no public exploit code.

Other vulnerabilities in Glpi-Project Glpi

• CVE-2022-35914 Teclib GLPI Remote Code Execution Exploited Critical 9.8
• CVE-2023-42802 GLPI vulnerable to unallowed PHP script execution Critical 10.0
• CVE-2023-28849 GLPI vulnerable to SQL injection and Stored XSS via inventory agent request Critical 10.0
• CVE-2022-35947 SQL injection in GLPI Critical 10.0
• CVE-2022-31056 SQL injection with _actor parameter in GLPI Critical 9.8

All Glpi-Project Glpi vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-AJ93268, GHSA-5vvr-pxwf-3w77, UBUNTU-CVE-2025-21626.