CVE-2026-22247 Details
Description
GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLPI administrator can perform SSRF request through the Webhook feature. This issue has been patched in version 11.0.5.
A server-side request forgery (SSRF) vulnerability has been identified in GLPI versions 11.0.0 prior to 11.0.5. This issue allows GLPI administrators to send unauthorized requests to internal or external resources through the Webhook feature.
Users are advised to upgrade to GLPI version 11.0.5, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/glpi-project/glpi/releases/tag/11.0.5 | [email protected] | ProductRelease Notes |
| https://github.com/glpi-project/glpi/security/advisories/GHSA-f6f6-v3qr-9p5x | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| glpi-project glpi | >= 11.0.0, < 11.0.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 6, 2026 | Initial Analysis | [email protected] |
| Feb 4, 2026 | New CVE Received | [email protected] |