CVE-2022-35914
Teclib GLPI Remote Code Execution Vulnerability
Published Sep 19, 2022 · updated Jun 16, 2026 · glpi-project glpi
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Sep 19, 2022 · Catalog
Detected
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
Mar 7, 2023 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Mar 28, 2023 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
Required action
Apply updates per vendor instructions.
CISA due date Mar 28, 2023
Affected
- cpe glpi-project/glpiversion unspecified
- vendor Teclib GLPIversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2022-35914
Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed.
cisa.gov - CVE.orgVulnerability recordCVE-2022-35914
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2022-35914
30-day exploitation probability 99.9%
first.org - Exploit DatabasePublic exploit reference52023
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit ModulesPublic exploit moduleexploit_linux/http/glpi_htmlawed_php_injection
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDVulnerability recordCVE-2022-35914
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
nvd.nist.gov - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html
Packet Storm link already published on the finding.
packetstormsecurity.com