CVE-2022-24868

    Dashboard / Vulnerabilities / CVE-2022-24868

    CVE-2022-24868

    Published: 21 Apr 2022Last Modified: 12 Aug 2026

    Summary: Cross site scripting via SVG file upload in GLPI

    Details: GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can exploit a lack of sanitization on SVG file uploads and inject javascript into their user avatar. As a result any user viewing the avatar will be subject to a cross site scripting attack. Users of GLPI are advised to upgrade. Users unable to upgrade should disallow SVG avatars.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24868.json, https://github.com/glpi-project/glpi/security/advisories/GHSA-9hg4-fpwv-gx78, https://nvd.nist.gov/vuln/detail/CVE-2022-24868, https://github.com/glpi-project/glpi/commit/1aa9fcc4741a46fa5a9f11d71b409b911ffc190f

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -815997021a5df4feb7077a12f6f52769e9bd3459

    Affected versions

    10.0.0-rc3
    10.0.0-rc2
    10.0.0-rc1
    10.0.0-beta

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-24868 | CVE-DB