CVE-2025-54780: GLPI Screenshot Plugin Info Leak Flaw

CVE-2025-54780 Overview

CVE-2025-54780 affects the glpi-screenshot-plugin, a GLPI extension that allows users to capture screenshots or record screens directly from the GLPI interface. Versions below 2.0.2 expose the /ajax/screenshot.php endpoint to authenticated users without proper input validation. An authenticated user can abuse this endpoint to read arbitrary files from the host filesystem or invoke PHP stream wrappers (e.g., php://, file://, phar://) to escalate the attack surface. The maintainer addressed the issue in version 2.0.2. This vulnerability is classified as External Control of File Name or Path [CWE-73].

Critical Impact
Authenticated GLPI users can leak sensitive files from the server filesystem and abuse PHP wrappers via the screenshot plugin AJAX endpoint.

Affected Products

cconard96/glpi-screenshot-plugin versions prior to 2.0.2
GLPI instances with the screenshot plugin enabled
All deployments allowing authenticated low-privilege user access

Discovery Timeline

2025-08-05 - CVE-2025-54780 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54780

Vulnerability Analysis

The glpi-screenshot-plugin exposes /ajax/screenshot.php to handle screenshot-related actions for authenticated GLPI sessions. The endpoint accepts a file path parameter without restricting the resolved path to the plugin's intended directory. Because the parameter is passed to PHP filesystem functions, an attacker can supply traversal sequences such as ../ to escape the expected directory.

The endpoint also fails to filter PHP stream wrapper schemes. Wrappers including php://filter, file://, and phar:// can be leveraged to read source files, leak configuration data, or trigger deserialization through Phar metadata. The exposure scope is CHANGED because the plugin runs in the GLPI web context but can read files outside the application directory.

Root Cause

The root cause is improper neutralization of attacker-controlled file path input passed into PHP file-handling functions inside ajax/screenshot.php. The plugin does not canonicalize the path, does not validate the resolved location against an allowlist, and does not strip stream wrapper prefixes. This matches [CWE-73] (External Control of File Name or Path).

Attack Vector

An authenticated GLPI user issues a crafted HTTP request to /ajax/screenshot.php with a file path parameter pointing outside the plugin directory or referencing a PHP wrapper. The server returns the contents of the requested resource, exposing system files such as /etc/passwd, GLPI configuration files containing database credentials, or source code retrievable through php://filter/convert.base64-encode/resource=.

php

// Patch excerpt from ajax/config.php (commit 49215b5)
 Html::header_nocache();
 
-Session::checkLoginUser();
-
 if ($_SERVER['REQUEST_METHOD'] !== 'GET') {
    // Bad request method
    die(405);
 }
 
 $config = Config::getConfigurationValues('plugin:screenshot');
 echo json_encode($config, JSON_FORCE_OBJECT | JSON_UNESCAPED_SLASHES);

Source: GitHub Commit 49215b5. The full commit hardens path handling in the screenshot AJAX flow and adjusts auth checks in related ajax handlers.

Detection Methods for CVE-2025-54780

Indicators of Compromise

HTTP requests to /plugins/screenshot/ajax/screenshot.php containing ../, ..%2f, or encoded traversal sequences in parameters.
Requests to the same endpoint containing PHP wrapper prefixes such as php://filter, file://, phar://, or data://.
Web server responses returning unexpected content types (e.g., base64-encoded PHP source) from the screenshot endpoint.
Access patterns from low-privilege GLPI accounts retrieving file paths unrelated to screenshot artifacts.

Detection Strategies

Inspect web access logs for the screenshot.php endpoint and flag any request with traversal or wrapper tokens in the query string or POST body.
Correlate authenticated GLPI session activity with subsequent reads of sensitive files such as config_db.php, /etc/passwd, or /proc/self/environ.
Add web application firewall rules that block requests to plugin ajax endpoints when parameters contain known stream wrapper schemes.

Monitoring Recommendations

Monitor process and file access telemetry on the GLPI web host for the php-fpm or Apache user reading files outside the GLPI web root.
Alert on GLPI audit log entries showing screenshot plugin activity from accounts that do not normally use the feature.
Track outbound responses from /ajax/screenshot.php exceeding expected sizes for image payloads.

How to Mitigate CVE-2025-54780

Immediate Actions Required

Upgrade glpi-screenshot-plugin to version 2.0.2 or later on all GLPI instances.
Audit GLPI authentication logs for unexpected access to the screenshot ajax endpoint since the plugin was installed.
Rotate any credentials stored in GLPI configuration files if exposure is suspected, including database and LDAP credentials.
Restrict GLPI account provisioning and review which user roles can reach plugin endpoints.

Patch Information

The maintainer fixed the issue in version 2.0.2. Refer to the GitHub Security Advisory GHSA-x6mp-jhxw-9xrp and the remediation commit 49215b5 for full details on the changes applied to the ajax handlers.

Workarounds

Disable the screenshot plugin in GLPI until the upgrade to 2.0.2 is deployed.
Restrict access to /plugins/screenshot/ajax/screenshot.php at the reverse proxy or web server layer.
Set allow_url_include = Off and disable unused PHP stream wrappers in php.ini to limit wrapper abuse impact.

bash

# Example nginx rule to block requests to the vulnerable endpoint until patched
location ~* /plugins/screenshot/ajax/screenshot\.php$ {
    return 403;
}

# Verify the installed plugin version
grep -R "version" /var/www/glpi/plugins/screenshot/setup.php