CVE-2022-35914: GLPI htmlawed Test Script PHP Code Injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS of 9.8, KEV listing, and near-maximum EPSS makes this an urgent patch-first issue.

What it is

The htmLawed test script shipped inside GLPI up to 10.0.2 allows PHP code injection through the htmlawed module. Because the vulnerable file is reachable over the network without authentication, it exposes GLPI installations to remote code execution.

Impact

An unauthenticated attacker can execute arbitrary PHP code on the server, leading to full compromise of the GLPI host and any data it holds.

Attack surface

Reached over the network via the exposed htmLawedTest.php path; the CVSS vector shows no privileges or user interaction required.

Exploitation

CISA added it to KEV on 2023-03-07, EPSS is 0.9988 (99.9th percentile), and public exploit references exist, so active exploitation should be assumed.

What to do

• Upgrade GLPI to 10.0.3 or later, which removes or fixes the vulnerable htmLawed test script.
• If immediate upgrade is not possible, block or remove access to /vendor/htmlawed/htmlawed/htmLawedTest.php at the web server or WAF.
• Restrict network exposure of GLPI management interfaces to trusted networks only.
• After patching, review server logs and file integrity for signs of prior compromise.

Detection

• Monitor web logs for requests to /vendor/htmlawed/htmlawed/htmLawedTest.php, especially with unusual parameters.
• Alert on PHP process spawning unexpected child processes or outbound connections from the GLPI server.
• Check for newly created or modified PHP files under the GLPI web root.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.