CVE-2022-35914

This flaw lets an attacker trick your GLPI system into running their own PHP code instead of only the intended page content. Think of it like a restaurant that accidentally leaves a “back door” in the kitchen where someone could swap out the chef’s instructions and have the kitchen follow them. Because it’s a code-injection issue, the impact can range from taking over parts of the site to exposing sensitive data, depending on how your server is set up.

This matters to you if you use or run GLPI Project GLPI, because the vulnerability is in the htmlawed module shipped with GLPI versions up to 10.0.2. It also applies to ООО «Ред Софт» РЕД ОС only as far as they package or distribute GLPI with the affected htmlawed module. If you are not running GLPI, you are likely not affected by this specific issue.

This is RED (urgent). It has a public exploit, is listed in CISA KEV as known exploited, and the estimated probability of exploitation is extremely high—meaning attackers are very likely to attempt it soon. Even though press reports don’t confirm exploitation in the wild for every environment, the combination of “known exploited” and “public exploit available” is enough to treat this as an immediate priority.