CVE-2022-35914: Teclib GLPI Remote Code Execution Vulnerability

CVE-2022-35914 is a remote code execution vulnerability affecting Teclib GLPI. It stems from a flaw in the third-party library htmlawed that GLPI incorporates. Successful exploitation can let an attacker run arbitrary code on the host system, which matters because GLPI is commonly used for IT asset and helpdesk management and often holds sensitive inventory, user, and configuration data. Defenders should treat this as a high-priority issue for any exposed or internet-facing GLPI deployment and confirm all details against the vendor advisory.

CISA lists the required action as applying updates per vendor instructions. Known ransomware use is not documented for this CVE.

How it works

The underlying weakness is CWE-74, improper neutralization of special elements in output used by a downstream component (injection). In this case the injection path involves the htmlawed library that GLPI relies on for HTML processing. An attacker who can supply crafted input that reaches the vulnerable library code can cause the application to execute unintended commands or code on the server. Exact request formats, authentication requirements, and payload construction are not detailed in the available facts; treat any public proof-of-concept claims with caution and validate behavior only against the official vendor advisory and your own controlled testing. Because the result is remote code execution, a successful attack typically yields the privileges of the web-server or PHP process running GLPI, enabling further lateral movement, data theft, or persistence.

Am I affected? How to find it in your systems

Teclib GLPI is typically deployed as a web application on Linux or Windows servers, often behind Apache or Nginx with PHP, and is used by IT teams for asset tracking, ticketing, and inventory. Inventory every instance by searching configuration-management databases, internal software catalogs, container registries, and network scans for hosts serving GLPI login pages or known GLPI paths. Check the installed version and the presence of the htmlawed library against the ranges listed in the vendor advisory; do not rely on version numbers not supplied here. Review web-server and application logs for anomalous requests that target HTML-processing or sanitization endpoints, unexpected PHP errors, or outbound connections originating from the GLPI process. Also examine process lists and file-system timestamps for newly created or modified scripts under the GLPI document root. If GLPI is reachable from untrusted networks, prioritize those instances first.

How to remediate

Patch first: apply the updates published by Teclib for GLPI exactly as instructed in the vendor advisory. After patching, restart the web and PHP services, verify the new version is running, and re-test the previously vulnerable functionality in a non-production environment if possible. For this injection class, also ensure that any custom plugins or third-party extensions that interact with HTML input are updated or reviewed. Harden the installation by running the web process under a least-privilege account, restricting write permissions on the application directories, and enabling PHP security settings that limit code execution (for example, disabling dangerous functions where operationally feasible). Confirm that the htmlawed library itself has been replaced or patched as part of the vendor update.

If you can't patch immediately

Until the official update can be applied, reduce exposure with compensating controls. Segment the GLPI host so that only authorized management networks can reach the web interface; block direct internet access if it is not required. Deploy a web-application firewall or reverse-proxy rules that inspect and block requests containing suspicious HTML or injection patterns directed at GLPI endpoints—treat these as virtual patches and tune them carefully to avoid false positives. If the vulnerable functionality can be disabled through configuration without breaking core operations, do so. Increase monitoring: alert on unusual process creation by the web-server user, unexpected file writes under the GLPI tree, and spikes in error rates related to HTML processing. Maintain offline backups of the GLPI database and configuration so that recovery remains possible if compromise occurs.

If your data may have been exposed

Actively exploited remote-code-execution vulnerabilities frequently lead to data breaches. If you have evidence of exploitation or cannot rule it out, assume that credentials, asset inventories, and any other data stored in GLPI may have been accessed. Rotate credentials, review access logs, and follow your incident-response plan. As an additional check, individuals can run a free exposure scan of their work email addresses against known breach data sets to determine whether those addresses appear in previously disclosed incidents.