CVE-2026-53629

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53629
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53629.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53629
Aliases
  • GHSA-cpcj-x335-5cmh
Downstream
Published
2026-09-25T18:38:43Z
Modified
2026-10-21T02:58:29Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
GLPI: SQL injection in history tab
Details

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-89"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53629.json"
}
References

Affected packages

Git / github.com/glpi-project/glpi

Affected ranges

Type
GIT
Repo
https://github.com/glpi-project/glpi
Events
Introduced
1783b781b221fe4212806c910dec3898c079c59f
Fixed
17b6d8de504deb8fa14825a86824f0f1cac9e10d
Introduced
b5cb4adb3c350521d85209d49e29e8619cdf8316
Fixed
1056d00af818ad2a99e3009a21a9db8c724ddc53
Fixed
1296798fb03295d07c1d97fa8483d1dbab59fef5
Fixed
80b86c0dcad2f6ece9b5da445d1c264a1dda3ce5
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "9.4.0"
                },
                {
                    "fixed":  "10.0.26"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "11.0.0"
                },
                {
                    "fixed":  "11.0.8"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "1296798fb03295d07c1d97fa8483d1dbab59fef5"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "80b86c0dcad2f6ece9b5da445d1c264a1dda3ce5"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "10.0.26",
            "range":  [
                {
                    "fixed":  "17b6d8de504deb8fa14825a86824f0f1cac9e10d"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "11.0.8",
            "range":  [
                {
                    "fixed":  "1056d00af818ad2a99e3009a21a9db8c724ddc53"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

10.*
10.0.0
10.0.0-beta
10.0.0-rc1
10.0.0-rc2
10.0.0-rc3
10.0.1
10.0.10
10.0.11
10.0.12
10.0.13
10.0.14
10.0.15
10.0.16
10.0.17
10.0.18
10.0.19
10.0.2
10.0.20
10.0.21
10.0.22
10.0.23
10.0.24
10.0.25
10.0.3
10.0.4
10.0.5
10.0.6
10.0.7
10.0.8
10.0.9
11.*
11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
11.0.5
11.0.6
11.0.7
9.*
9.4.0
9.4.1
9.4.1.1
9.5.0-rc1
9.5.0-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53629.json"