Executive Summary

CVE-2025-64516 is a high-severity vulnerability in the GLPI asset and IT management software that allows unauthorized users to access documents attached to any item (such as tickets or assets). If the public FAQ feature is enabled, even anonymous users without any privileges can exploit this flaw. The root cause is improper access control due to insufficient filtering of document-item relationships, allowing documents not properly linked to an item to be accessed. The vulnerability arises from authorization bypass through user-controlled keys and improper SQL query joins, which were fixed by changing LEFT JOINs to INNER JOINs and adding strict filtering conditions to ensure documents are only accessible if explicitly linked to the item and the user has appropriate permissions. [1, 3, 4]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive documents within the GLPI system, resulting in a high confidentiality loss. Unauthorized or anonymous users may gain access to documents they should not see, potentially exposing sensitive information related to IT assets, tickets, or other managed items. This can compromise the privacy and security of organizational data and may lead to further exploitation or data breaches. [2, 4, 5]

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate CVE-2025-64516, immediately upgrade your GLPI installation to version 10.0.21 or 11.0.3, as these versions include the security fixes that prevent unauthorized access to documents. The updates address improper access control by enforcing strict document-item relation filtering and improving permission checks. Applying these official patches is the recommended and effective mitigation step. [2, 5, 4]

Useful 0 Not Useful 0