---
id: CVE-2025-64520
title: GLPI is a free asset and IT management software package
summary: >-
  GLPI is a free asset and IT management software package. Starting in version
  9.1.0 and prior to version 10.0.21, an unauthorized user with an API access
  can read all knowledge base entries. Users should upgrade to 10.0.21 to
  receive a pa…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-862
vendor: glpi-project
product: glpi
affected:
  - 'glpi >= 9.1.0, < 10.0.21'
patched:
  - glpi 10.0.21
published: '2025-12-16'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T11:10:00.203'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-64520'
references:
  - url: >-
      https://github.com/glpi-project/glpi/commit/a3d5cc4a63ae592c0b5592ebe6d562164904dab3
    label: security-advisories@github.com
  - url: >-
      https://github.com/glpi-project/glpi/security/advisories/GHSA-62p9-prpq-j62q
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00216
epssPercentile: 0.111
ingestedAt: '2026-10-13T11:23:51.115Z'
---

## Overview

GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.21, an unauthorized user with an API access can read all knowledge base entries. Users should upgrade to 10.0.21 to receive a patch.

## Affected

- `glpi >= 9.1.0, < 10.0.21`

## Remediation

Upgrade past the affected range:

- `glpi 10.0.21`