CVE-2025-53113 GLPI technicians can access unauthorized information through external links

What is CVE-2025-53113?

CVE-2025-53113 is a low-severity vulnerability in Glpi-Project Glpi, published on 30 Jul 2025.

Official description

GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.65 through 10.0.18, a technician can use the external links feature to fetch information on items they do not have the right to see. This is fixed in version 10.0.19.

Weakness: CWE-862, CWE-284

Which versions are affected by CVE-2025-53113?

It affects 1 product.

Products include Glpi-Project Glpi.

How do I fix CVE-2025-53113?

No fix has been published for CVE-2025-53113 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-53113 being exploited?

There is no known exploitation of CVE-2025-53113 in the wild and no public exploit code.

Other vulnerabilities in Glpi-Project Glpi

• CVE-2022-35914 Teclib GLPI Remote Code Execution Exploited Critical 9.8
• CVE-2023-42802 GLPI vulnerable to unallowed PHP script execution Critical 10.0
• CVE-2023-28849 GLPI vulnerable to SQL injection and Stored XSS via inventory agent request Critical 10.0
• CVE-2022-35947 SQL injection in GLPI Critical 10.0
• CVE-2022-31056 SQL injection with _actor parameter in GLPI Critical 9.8

All Glpi-Project Glpi vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r2mm-6499-4m8j, UBUNTU-CVE-2025-53113.