CVE Intelligence
Analysis AI-assisted

CVE-2026-22247: GLPI: SSRF via Webhook feature

GLPI versions from 11.0.0 up to before 11.0.5 contain a server-side request forgery (SSRF) flaw in the Webhook feature, which a GLPI administrator can trigger. NVD rates it 9.1 under CVSS 3.1, and the description states the issue is patched in 11.0.5. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

GLPI is a free asset and IT management software package. According to the vendor advisory and the CVE record, versions from 11.0.0 before 11.0.5 allow a GLPI administrator to make the server perform a server-side request forgery (SSRF) through the Webhook feature. The weakness is classified as CWE-918. The record states the issue is patched in version 11.0.5.

Impact

  • An SSRF lets the GLPI server send requests to destinations chosen through the vulnerable feature. Whether this reaches internal networks or cloud metadata services is not described in the record.
  • NVD scores the issue 9.1 under CVSS 3.1 with high confidentiality, integrity and availability impact. GitHub's CNA lists a lower score of 4.1 under CVSS 3.1. The record does not explain the difference.
  • The required privilege is administrator level, which limits who can exploit it but does not remove the risk from compromised or over-privileged administrator accounts.

Affected products and versions

  • Product listed in the record: Glpi-project GLPI.
  • Affected range: 11.0.0 or later and before 11.0.5.
  • The record lists no separate fixes entry. The description and the release reference point to 11.0.5 as the patched version.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation in the wild appears in the sources consulted for this analysis. EPSS data is not available in the record.

Remediation and mitigation

  • Upgrade GLPI to version 11.0.5 or later, as indicated by the vendor advisory and the release notes.
  • Until the upgrade is applied, review which accounts hold administrator rights and remove unnecessary privileges.
  • Review existing Webhook configurations for entries that were not created by authorized staff.
  • Where feasible, limit outbound network access from the GLPI server to only the destinations it needs.

Detection guidance

  • Audit changes to Webhook configurations and the administrator accounts that made them.
  • Monitor outbound connections from the GLPI server to unexpected internal addresses or external hosts.
  • Correlate administrator activity in GLPI logs with unusual network behavior from the application server.

Limitations of the available information

The record does not describe the technical mechanics of the flaw, the specific Webhook parameters involved, or which internal targets could be reached. The reason for the difference between the NVD and GitHub scores is not stated. The record contains no EPSS or SSVC data. Whether earlier releases or other products are affected is not stated beyond the listed range.

Frequently asked questions

What is CVE-2026-22247?

It is a server-side request forgery (SSRF) vulnerability in the Webhook feature of GLPI, an asset and IT management package. The record says a GLPI administrator can trigger it in versions from 11.0.0 before 11.0.5.

Which version fixes it?

The record states the issue is patched in GLPI 11.0.5. The release notes for 11.0.5 are referenced in the record.

Is this vulnerability being actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.