Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-37149 is a high-severity External Control of File Name or Path (CWE-73) vulnerability in Glpi-Project Glpi. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
GLPI, an open-source asset and IT management software package providing ITIL Service Desk features along with license tracking and software auditing, contains a vulnerability tracked as CVE-2024-37149. An authenticated technician user can upload a malicious PHP script and hijack the plugin loader to execute arbitrary code on the server. The flaw is associated with CWE-73 and CWE-94 and is rated 7.2 under CVSS 3.1.
An attacker possessing technician credentials can exploit the issue remotely with low attack complexity and no user interaction required, resulting in full control over confidentiality, integrity, and availability of the GLPI instance.
The referenced GitHub security advisories for the project state that the vulnerability is resolved by upgrading to version 10.0.16.
The associated EPSS score has remained flat at 0.0833 with no material rise after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-36966
Vulnerability Data
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated technician user can upload a malicious PHP script and hijack the plugin loader to execute this malicious…
more
script. Upgrade to 10.0.16.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2V1.3.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation finds code paths that accept and execute externally influenced strings.
Input validation directly rejects or sanitizes untrusted path strings before they reach filesystem operations.
Enforces authorization checks on the actual resource accessed, blocking unauthorized files even when a malicious path is supplied.
Least-privilege limits the set of files or directories any subject can affect, shrinking the blast radius of a path-control flaw.
Requiring documented secure development standards and tools enforces use of safe code-generation APIs and escaping.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices include input validation and path sanitization that eliminate this weakness.
Least-privilege file authorization directly limits damage from externally controlled paths.
PR.DS-10 protects runtime data confidentiality/integrity but has no bearing on neutralizing externally influenced input during code generation, so neither direction shows any preventive effect.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect path-traversal issues but does not itself implement preventive controls.
Secure development lifecycle mandates input validation and path-handling controls that directly prevent external file/path manipulation.
Application security requirements explicitly call for controls against untrusted input influencing file operations.
Secure architecture principles discourage unsafe path construction but do not prescribe concrete file-name controls.
Secure coding standards require canonicalization, allow-listing, and bounds checks on file paths, directly eliminating CWE-73.
Information access restriction limits which files can be reached, indirectly reducing impact of path manipulation.