CVE-2022-35914
Teclib GLPI Remote Code Execution Vulnerability
Published Sep 19, 2022 · updated Jun 16, 2026 · glpi-project glpi
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
Timeline
Detection, updates, and resolution for this record.
Sep 19, 2022 · Catalog
Detected
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
Mar 7, 2023 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Mar 28, 2023 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
Required action
Apply updates per vendor instructions.
CISA due date Mar 28, 2023
Affected
- cpe glpi-project/glpiversion unspecified
- vendor Teclib GLPIversion unspecified
Sources
- CISA KEVCVE-2022-35914
Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed.
cisa.gov - CVE.orgCVE-2022-35914
Official CVE identifier
cve.org - FIRST EPSSCVE-2022-35914
30-day exploitation probability 99.9%
first.org - Exploit Database52023
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_linux/http/glpi_htmlawed_php_injection
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2022-35914
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html
Packet Storm link already published on the finding.
packetstormsecurity.com