CVE-2025-52567: 
GLPI vulnerability analysis and mitigation

GLPI, a Free Asset and IT Management Software package for data center management, ITIL Service Desk, and software auditing, was found to contain a Server-Side Request Forgery (SSRF) vulnerability in versions 0.84 through 10.0.18. The vulnerability specifically affects the usage of RSS feeds and external calendars when planning, where previous security patches provided since GLPI 10.0.4 were found to be insufficient for certain specific cases (GitHub Advisory, NVD).

The vulnerability has been assigned CVE-2025-52567 and is classified as CWE-918 (Server-Side Request Forgery). It received a CVSS v3.1 base score of 5.0 (MEDIUM) from NIST NVD with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, while GitHub assessed it at 3.5 (LOW) with vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N. The vulnerability is network-accessible and requires low privileges to exploit, though no user interaction is needed (NVD).

The vulnerability primarily affects the confidentiality of data, with a low impact rating. There are no reported impacts on system integrity or availability. The scope is changed, indicating that the vulnerable component can impact resources beyond its security scope (GitHub Advisory).

The vulnerability has been fixed in GLPI version 10.0.19. Users are advised to upgrade to this version to mitigate the risk. No alternative workarounds have been publicly documented (GitHub Advisory).