CVE-2025-53113: 
GLPI vulnerability analysis and mitigation

GLPI (Gestionnaire Libre de Parc Informatique), a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing, contains a security vulnerability in versions 0.65 through 10.0.18. The vulnerability was discovered and disclosed in July 2025, with a fix released in version 10.0.19 (GitHub Advisory).

The vulnerability has been assigned CVE-2025-53113 with a CVSS v3.1 base score of 2.7 (Low severity). The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector, low attack complexity, high privileges required, no user interaction needed, unchanged scope, low confidentiality impact, and no impact on integrity or availability. The vulnerability is classified under CWE-284 (Improper Access Control) and CWE-862 (Missing Authorization) (NVD).

The vulnerability allows technicians to use the external links feature to fetch information on items they do not have the right to see, resulting in unauthorized access to restricted information. The impact is limited to confidentiality breaches with no effect on system integrity or availability (GitHub Advisory).

The vulnerability has been fixed in GLPI version 10.0.19. Users are advised to upgrade to this version to mitigate the security risk. No alternative workarounds have been provided (GitHub Advisory).