CVE-2025-52897: 
GLPI vulnerability analysis and mitigation

GLPI, a Free Asset and IT Management Software package, was found to contain a vulnerability (CVE-2025-52897) affecting versions 9.1.0 through 10.0.18. The vulnerability allows an unauthenticated user to send a malicious link to attempt a phishing attack through the planning feature. The issue was discovered and disclosed on July 29, 2025, and has been fixed in version 10.0.19 (GitHub Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The vulnerability is associated with two CWE categories: CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page - Basic XSS) and CWE-601 (URL Redirection to Untrusted Site - Open Redirect). These weaknesses indicate that the vulnerability involves both cross-site scripting and open redirect vulnerabilities in the planning feature (GitHub Advisory, NVD).

The vulnerability allows attackers to potentially execute phishing attacks through malicious links. The CVSS metrics indicate high impact on confidentiality while integrity and availability remain unaffected. The attack requires user interaction but can be initiated by an unauthenticated user (GitHub Advisory).

The vulnerability has been patched in GLPI version 10.0.19. Users are advised to upgrade to this version to mitigate the security risk. No alternative workarounds have been published (GitHub Advisory).