
POC for Unauthorized access to documents. CVE-2025-64516
POC for Unauthorized access to documents. CVE-2025-64516
An unauthenticated user can access GLPI documents attached to any item (ticket, asset, ...).
Versions >= 10.0.0, < 11.0.0
Versions >= 11.0.0
Upgrade to 10.0.21
Upgrade to 11.0.3
git clone https://github.com/ArdNoir/CVE-2025-64516.git
cd CVE-2025-64516
python exploit.py -h

Document::canViewFileFromItem() was not filtering the result for the current document. It means that as long as a document was attached to the knowbase item with the given itemtype/items_id, a request to any document was considered as allowed.
[!WARNING] This script is intended for educational and research purposes only. Do not use it against systems without explicit permission. Unauthorized access or testing is illegal and unethical. The author shall not be held liable for any misuse, damage, third-party claims, or legal consequences arising from the use, modification, or distribution of the materials in this repository.