CVE-2026-53629: GLPI Asset Management SQL Injection Flaw

CVE-2026-53629 Overview

GLPI is a free, open-source asset and IT service management (ITSM) software package widely deployed by enterprises and service providers. CVE-2026-53629 is a SQL injection vulnerability [CWE-89] in the history tab endpoint of GLPI. An authenticated attacker holding the READ right on logs can craft a URL that injects attacker-controlled values into a database query. The flaw affects GLPI from version 9.4.0 through 10.0.25 and 11.0.7. The GLPI project resolved the issue in versions 10.0.26 and 11.0.8.

Critical Impact
Authenticated users with log-read permissions can execute arbitrary SQL queries against the GLPI database, exposing credentials, asset data, and configuration secrets.

Affected Products

GLPI 9.4.0 through 10.0.25
GLPI 11.0.0 through 11.0.7
Fixed in GLPI 10.0.26 and 11.0.8

Discovery Timeline

2026-09-25 - CVE-2026-53629 published to NVD
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-53629

Vulnerability Analysis

The vulnerability resides in the GLPI history (log) viewing functionality implemented in src/Log.php. When a user accesses the history tab, GLPI parses an affected_field parameter containing one or more semicolon-separated segments of the form key:operator:values. The parser extracted the key component directly from the URL and reused it when constructing a database query. Because the code did not validate the key against an allow-list, an attacker could substitute a column name or SQL fragment of their choosing.

Any account holding the READ right on logs can trigger the vulnerable code path, which lowers the bar for exploitation in multi-tenant GLPI deployments. Successful injection yields read access to database contents, including user password hashes, API tokens, inventory data, and plugin configuration.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The affected parser accepted arbitrary strings for the key field and passed them into query construction without parameterization or allow-list validation.

Attack Vector

Exploitation requires network access to the GLPI web interface and an authenticated session with the READ right on logs. The attacker crafts a URL targeting the history tab of an item (for example, a Computer or Ticket) and supplies a malicious affected_field segment. The injected SQL is executed in the context of the GLPI database user.

php

// Patch in src/Log.php restricts the key component to a safe allow-list
foreach (explode(";", $affected_field) as $var) {
    if (1 === preg_match('/^(?P<key>.+):(?P<operator>.*):(?P<values>.+)$/', $var, $matches)) {
        $key = $matches['key'];
        $allowed_keys = ['linked_action', 'id_search_option', 'itemtype_link'];
        if (!in_array($key, $allowed_keys, true)) {
            continue;
        }
        $operator = $matches['operator'];
        if (!empty($operator) && $operator != 'NOT') {
            throw new RuntimeException('Invalid operator: ' . $operator);
        }
        // ...
    }
}

Source: GitHub Commit 1296798f

Detection Methods for CVE-2026-53629

Indicators of Compromise

Web server access logs containing requests to GLPI history tab endpoints with unusual affected_field parameter values that include SQL meta-characters such as single quotes, parentheses, UNION, SELECT, or SLEEP(.
Database query logs showing malformed or unexpected queries originating from the GLPI application user around log-view requests.
Repeated history-tab requests from a single authenticated session enumerating different itemtype or item_id values.

Detection Strategies

Enable MySQL or MariaDB general query logging in staging and inspect queries emitted by the Log viewer to identify injection attempts.
Deploy a web application firewall (WAF) rule that inspects the affected_field parameter for values whose key segment is not one of linked_action, id_search_option, or itemtype_link.
Correlate GLPI application audit logs with web-tier logs to identify low-privilege accounts generating anomalous history-tab traffic.

Monitoring Recommendations

Alert on any 5xx responses from GLPI history endpoints, which may indicate failed injection attempts triggering runtime exceptions.
Monitor authentication of accounts that hold only the log READ right for abnormal session duration or request volume.
Baseline normal GLPI query patterns and alert on sudden spikes in information_schema, glpi_users, or glpi_configs references.

How to Mitigate CVE-2026-53629

Immediate Actions Required

Upgrade GLPI to version 10.0.26 or 11.0.8 as published by the GLPI project.
Audit accounts that have been granted the READ right on logs and remove the privilege where it is not operationally required.
Rotate GLPI database credentials, API tokens, and any secrets stored in glpi_configs if exploitation is suspected.

Patch Information

The fix is delivered in GLPI releases 10.0.26 and 11.0.8. The code change in src/Log.php enforces an allow-list of acceptable key values (linked_action, id_search_option, itemtype_link) before the parsed value is used in query construction. See GitHub Security Advisory GHSA-cpcj-x335-5cmh and the patch commits 1296798f and 80b86c0d for details.

Workarounds

Remove the log READ right from all non-administrative GLPI profiles until the patched release can be deployed.
Place GLPI behind a WAF and block requests whose affected_field parameter contains SQL meta-characters or key segments outside the allow-list.
Restrict network access to the GLPI web interface to trusted administrative networks or VPN clients.

bash

# Upgrade GLPI on a Linux host (example for a tarball install)
cd /var/www
wget https://github.com/glpi-project/glpi/releases/download/10.0.26/glpi-10.0.26.tgz
tar -xzf glpi-10.0.26.tgz
# Follow the official GLPI upgrade procedure to migrate the database schema