PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-29047 Glpi Project CVE debrief

CVE-2026-29047 is a SQL injection vulnerability in GLPI, a free asset and IT management software package. An authenticated user can exploit this vulnerability via the logs export feature in versions from 10.0.0 to before 10.0.24 and 11.0.6. The vulnerability is fixed in versions 10.0.24 and 11.0.6. This vulnerability can lead to potential data theft or unauthorized data modifications, and defenders should prioritize patching or mitigating this vulnerability, especially in environments where authenticated users have access to the logs export feature.

Vendor
Glpi Project
Product
Glpi
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-06
Original CVE updated
2026-10-26
Advisory published
2026-04-06
Advisory updated
2026-10-26

Who should care

Defenders and IT administrators responsible for GLPI installations should assess exposure and prioritize patching or mitigating this vulnerability.

Why it matters

CVE-2026-29047 is a SQL injection vulnerability in GLPI that can be exploited by authenticated users via the logs export feature. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where authenticated users have access to the logs export feature. The vulnerability is fixed in versions 10.0.24 and 11.0.6.

  • Potential data theft or unauthorized data modifications
  • Possible disruption of IT asset management services
  • Required verification of GLPI installation versions and exposure

Technical summary

CVE-2026-29047 is a SQL injection vulnerability in GLPI, a free asset and IT management software package. An authenticated user can exploit this vulnerability via the logs export feature in versions from 10.0.0 to before 10.0.24 and 11.0.6. The vulnerability allows for potential data theft or unauthorized data modifications, and defenders should prioritize patching or mitigating this vulnerability.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where authenticated users have access to the logs export feature.

Recommended defensive actions

  • Patch GLPI to version 10.0.24 or 11.0.6
  • Restrict access to the logs export feature
  • Monitor logs for suspicious activity

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, its impact, and the affected versions. The vulnerability has been fixed in versions 10.0.24 and 11.0.6. There is no evidence of exploitation in the wild, but defenders should verify GLPI installation versions and exposure. The logs export feature is a key area of focus for defenders.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-29047 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-29047

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-29047 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-29047

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.