Nixpkgs security tracker

Dismissed

Permalink CVE-2026-22247

4.1 MEDIUM

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): HIGH
User interaction (UI): NONE
Scope (S): CHANGED
Confidentiality impact (C): LOW
Integrity impact (I): NONE
Availability impact (A): NONE

updated 2 months, 3 weeks ago by @LeSuisse Activity log

Created suggestion 2 months, 3 weeks ago
@LeSuisse ignored package glpi-agent 2 months, 3 weeks ago
@LeSuisse dismissed 2 months, 3 weeks ago

GLPI is Vulnerable to SSRF via Webhooks

GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLPI administrator can perform SSRF request through the Webhook feature. This issue has been patched in version 11.0.5.

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-f6f6-v3qr-9p5x x_refsource_CONFIRM
https://github.com/glpi-project/glpi/releases/tag/11.0.5 x_refsource_MISC

Affected products

glpi

==>= 11.0.0, < 11.0.5

Ignored packages (1)

pkgs.glpi-agent

GLPI unified Agent for UNIX, Linux, Windows and MacOSX

nixos-unstable 1.15
- nixpkgs-unstable 1.15
- nixos-unstable-small 1.15
nixos-25.11 1.15
- nixos-25.11-small 1.15
- nixpkgs-25.11-darwin 1.15

`glpi` is not available in nixpkgs

Suggestion detail

References

Affected products

pkgs.glpi-agent