GLPI hat eine übermäßig freizügige URL-Verifizierung

The SSRF vulnerability in GLPI arises from improper handling of RSS feeds and external calendar integrations used during planning. An attacker could craft malicious requests through these features, causing GLPI to send requests to internal services or external URLs that the attacker controls. This could expose sensitive internal data, allow for reconnaissance of the internal network, or even facilitate access to internal systems if those systems are vulnerable to further exploitation. While the CVSS score is LOW, the potential for internal reconnaissance and lateral movement makes this a concerning issue, especially in environments with sensitive internal resources.

Organizations heavily reliant on GLPI for asset and IT management, particularly those with complex internal networks and extensive use of RSS feeds or external calendar integrations for planning, are at increased risk. Shared hosting environments running GLPI are also vulnerable, as the attacker could potentially exploit the vulnerability through a compromised GLPI instance.

• php / server:

find /var/www/html/glpi -name 'index.php' -exec grep -i 'fetch_url' {} + | grep -i 'rss'

• generic web:

curl -I https://your-glpi-server/index.php?rss_url=http://internal-resource.local

• generic web:

curl -I https://your-glpi-server/app/planning/external_calendar.php?url=http://internal-resource.local

1. 2025-07-30Disclosure

   disclosure

1. Reserviert2025-06-18
2. Veröffentlicht2025-07-30
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-52567 is to upgrade GLPI to version 10.0.19 or later. If upgrading immediately is not feasible, consider temporarily disabling RSS feed and external calendar integrations within GLPI's planning features. Review GLPI's configuration to ensure that any external connections are properly validated and restricted. Implement a Web Application Firewall (WAF) with rules to block suspicious outbound requests originating from GLPI. Monitor GLPI logs for unusual outbound connections or requests to unexpected internal resources.