GLPI 11 unauthenticated SQL injection in front/planning.php lets anyone read the whole helpdesk and asset database (password hashes, tickets, users); fixed quietly in GLPI 11.0.9 in September, full write-up with working exploit requests published 20 October
French pentest firm Mobeta published a technical write-up on 20 October 2026 of an unauthenticated SQL injection in GLPI, the widely used open-source IT asset management and helpdesk platform. Sending both the genical and checkavailability parameters to front/planning.php skips the iCalendar token check, and the begin and end dates then reach a hand-built QueryExpression in the not-planned branch of CommonITILTask::genericPopulatePlanning() (the same pattern exists in ProjectTask) without escaping. An unauthenticated attacker can extract the full database with a time-based blind injection, including password hashes, configuration, inventory, tickets, projects and users; Mobeta says this can lead to administrator takeover and, depending on version, code execution. GLPI 11.0.8 and earlier 11.x releases are exploitable; GLPI 10.x has the same code but global input escaping blocks it; on the unreleased 12 development branch the bug would expose admin session IDs in clear text. Mobeta reported it on 3 August and GLPI fixed it in 11.0.9 on 16 September; the advisory GHSA-753w-2942-4pxm and a CVE are not yet published. GLPI's 7 October advisories fixed further planning-feature flaws (missing authorisation and user-name enumeration) in 11.0.10 and 10.0.28. No in-the-wild exploitation has been reported, but the write-up includes working request examples. Primary: Mobeta.
- Product
- GLPI (open-source IT asset management, helpdesk and service desk)
- Versions
- GLPI 11.0.x up to 11.0.8 exploitable; fixed in 11.0.9 (16 Sep 2026). 10.x not exploitable through this path. Latest: 11.0.10 / 10.0.28 (7 Oct 2026).
- CVSS
- not yet scored (no CVE or advisory published)
- Exploited in Australia?
- unknown
- Patch to
- Upgrade GLPI 11 to 11.0.10 (which includes the 11.0.9 SQL injection fix and the 7 October planning fixes); GLPI 10 sites should be on 10.0.28. Keep GLPI off the public internet or behind VPN or SSO where possible, block unauthenticated requests to front/planning.php that combine genical and checkavailability at the WAF or reverse proxy, and review web logs for such requests with quote characters in begin or end. If an exposed instance ran 11.0.8 or earlier, reset GLPI user passwords and API tokens and review admin accounts.
Primary: Mobeta — Unauthenticated SQL injection in GLPI (≤ 11.0.8) (20 Oct 2026) · Vendor: GLPI project — GitHub security advisories (GHSA-753w-2942-4pxm pending; 11.0.10 / 10.0.28 planning fixes 7 Oct 2026) · Talkback — resource listing (20 Oct 2026)