CVE-2022-35914

GLPI, a widely deployed open-source IT asset management platform, bundles a third-party htmlawed library whose htmLawedTest.php script permits unauthenticated PHP code injection (CWE-74) in GLPI versions through 10.0.2. An attacker triggers it by sending a crafted HTTP request with injected PHP parameters to the directly web-reachable /vendor/htmlawed/htmlawed/htmLawedTest.php script, with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N). Successful exploitation yields remote code execution on the web server as the web service account, enabling data theft, lateral movement, and follow-on activity such as ransomware staging or botnet recruitment. Any organization running GLPI 10.0.2 or earlier is affected, particularly internet-facing instances where the test script is directly reachable. The flaw is under active exploitation: it was added to CISA's Known Exploited Vulnerabilities Catalog on 2023-03-07 (required action: apply vendor updates), carries a 99.7% EPSS score, and multiple public proof-of-concept exploits are available.

What to do: Upgrade GLPI to a fixed release newer than 10.0.2 (or update the bundled htmlawed library to a patched version); as an interim mitigation, remove or block direct web access to /vendor/htmlawed/htmlawed/htmLawedTest.php. Prioritize internet-facing instances given active exploitation and the 99.7% EPSS score, and review web access logs for requests to htmLawedTest.php plus signs of webshells or unexpected administrator accounts. As a CISA KEV entry, federal agencies and other KEV subscribers are required to apply vendor updates per the catalog instructions.