Teclib GLPI Remote Code Execution Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2022-35914 · Published 19/09/2022 · updated 17/06/2026

Teclib GLPI Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 07/03/2023. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
glpi glpi-project	`≤ 10.0.2`	No fix yet

Description

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

References

packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html · Exploit
bioinformatics.org/phplabware/sourceer/sourceer.php · Patch
Orange-Cyberdefense/CVE-repository · Third Party Advisory
Orange-Cyberdefense/CVE-repository · Exploit
glpi-project/glpi release · Release Notes
glpi-project.org/fr/glpi-10-0-3-disponible · Release Notes
mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914 · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2022-35914

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free