CVE-2025-54780 — glpi-screenshot-plugin exposes local files in /ajax/screenshot.php
The glpi-screenshot-plugin allows users to take screenshots or screens recording directly from GLPI. In versions below 2.0.2, authenticated user can use the /ajax/screenshot.php…
Published: 2025-08-05 · CVSS: 7.7 · CVSS 3.1
The glpi-screenshot-plugin allows users to take screenshots or screens recording directly from GLPI. In versions below 2.0.2, authenticated user can use the /ajax/screenshot.php endpoint to leak files from the system or use PHP wrappers. This is fixed in version 2.0.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7