CVE-2022-35914: GLPI unauthenticated command execution, actively exploited
The short version: GLPI — the open-source IT asset and service-desk platform — ships a vulnerable htmLawed test endpoint (/vendor/htmlawed/htmlawed/htmLawedTest.php) that allows unauthenticated PHP code injection (CVE-2022-35914). An attacker bypasses the authentication check by manipulating a cookie and runs commands on the server. It's in CISA's KEV catalog. Patch and confirm your exposure. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated RCE, actively exploited |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.63% · 99th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediate by 2023-03-28 |
| Known exploited? | Yes — listed in CISA KEV |
| Vulnerability type | CWE-74 injection → PHP code injection → OS command execution |
| Requires authenticated session? | No — pre-authentication (auth check bypassed via the sid cookie) |
| Affected | GLPI through 10.0.2 |
| Fixed in | 10.0.3 |
What you need to know
GLPI bundles the htmLawed library, and its test script htmLawedTest.php is reachable on the server. The endpoint's authentication check can be bypassed by manipulating the sid cookie, and once past it, the attacker supplies input that GLPI passes to a PHP execution path — turning a "test" page into arbitrary command execution.
Why it's top-of-queue:
- It's pre-authentication and trivially reachable. No account, no chain — just a reachable GLPI instance running an affected version.
- GLPI holds the keys to your IT estate. As an asset and service-desk system, a compromised GLPI can expose inventory, tickets, and credentials across the environment.
- It's already being exploited. CISA added it to KEV; EPSS puts exploitation probability near-certain.
How serious we see it
High — the 9.8 holds up.
Unauthenticated, network-reachable command execution on an internet-facing management platform, KEV-listed and with near-certain exploitation activity, is top-of-queue. The bounded, reassuring part is that it's narrow and fixable: it affects GLPI through 10.0.2, the fix (10.0.3) is published, and exposure is quick to determine.
Recommendations
Straight from the GLPI project and CISA:
- Patch now. Upgrade to GLPI 10.0.3 or later.
- If you can't patch immediately, remove the test file. Delete or block access to
/vendor/htmlawed/htmlawed/htmLawedTest.php. - Hunt. Review web logs for POST requests to the htmLawed test endpoint and for signs of web shells or unexpected command execution.
- If compromised, respond. Rebuild where warranted and rotate credentials and secrets stored in or reachable from GLPI.
- Confirm your exposure first. Verify whether you run an internet-facing GLPI and which version.
How BreachRisk sees it
BreachRisk discovers internet-facing GLPI instances from little more than your domain, fingerprints the version, and flags exposure tied to this KEV-listed CVE — pushed to the top of your results because it's actively exploited. Where a bounded, non-disruptive check is safe, BreachRisk confirms the exposure rather than inferring it from a version string alone, so you get a straight answer instead of a maybe.
That continuous, attacker's-eye view means an exposed GLPI is already mapped and version-checked when a flaw like this matters most.