First time installation notes:
Before using GLPI, you will need to configure your database.
Full installation instructions are available here:
http://glpi-project.org/spip.php?article61
If you are using MySQL, here's the short version of the instructions:
1. Create a new database:
$ mysqladmin -uroot create glpi
2. Grant access to the database:
$ mysql -uroot -e"GRANT ALL ON glpi.* TO USERNAME@localhost IDENTIFIED BY 'PASSWORD'" glpi
(choose your own values for USERNAME and PASSWORD)
Make sure Apache supports PHP (www/mod_php5) and add a config file for
GLPI in Includes/glpi.conf:
Alias /glpi /usr/local/www/glpi
<Directory /usr/local/www/glpi>
AllowOverride Options FileInfo Limit
Options Indexes FollowSymLinks
Require all granted
DirectoryIndex index.php
</Directory>
Then reload Apache: 'apachectl graceful'
Please visit 'http://{host.domain}/glpi/' in a
web-browser and follow the configuration instructions.
Packages by version and architecture
latest
FreeBSD version
amd64
aarch64
i386
FreeBSD 16
11.0.1_1,1
11.0.1_1,1
–
FreeBSD 15
11.0.1_1,1
11.0.1_1,1
–
FreeBSD 14
11.0.1_1,1
11.0.1_1,1
11.0.1_1,1
quarterly (2026Q4)
FreeBSD version
amd64
aarch64
i386
FreeBSD 15
11.0.1_1,1
11.0.1_1,1
–
FreeBSD 14
11.0.1_1,1
11.0.1_1,1
11.0.1_1,1
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed (30)
The CVE record lists the packaged version 11.0.1_1,1 as affected, and no VuXML entry names the CVE. What does this mean?
Update to 11.0.8 fixes 29 of the 30 unaddressed CVEs.
1 CVE names no fixed version in the CVE record (for example only a commit).
Fixed up to each version, cumulative: 11.0.3 2 · 11.0.5 5 · 11.0.6 11 · 11.0.7 18 · 11.0.8 29
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifi…
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in…
GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the pr…
An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item.
This issue affects glpi: before 11.0.7.
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based blind SQL injection exists in GLPI's Search engine. …
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. From 11.0.0 to before …
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissio…
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change ano…
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup w…
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. T…
GLPI is a free asset and IT management software package. From 11.0.0, < 11.0.3, an unauthenticated user can perform a SQL injection through the inventory endpoint. This …
GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset,…
GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, an authenticated user can perform a SQL injection via the logs export …
GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab…
GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, a technician can store an XSS payload in a ITIL costs. This issue has been fi…
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 10.0.25 and 11.0.7, low privilege users with access to planning …
GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, a technician can delete arbitrary files from …
GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, an authenticated user with config READ permis…
GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's credentials…
GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can perfom a SQL injection. Versio…
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operati…
GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2…
GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 10.0.25 and 11.0.7, a technician can read arbitrary files inside …
GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by…
GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge …
GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode.…
GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, an authenticated user with forms READ permission can export the structure of …
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through …
GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used, based on…
GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLPI administrator can perform SSRF request through the Webhook feature.…
VuXML only (0)
Listed in VuXML, the packaged version 11.0.1_1,1 is still in the affected range; pkg audit reports it. What does this mean?
None.
Fixed (47)
Show 47 fixed
VuXML entries whose affected range the packaged version has left.
Problem reports (0) · open in Bugzilla, most recently changed first
None.
Commits (78)
Muhammad Moinur Rahman (bofh) · 11.0.1_1,1
*/*php86*: Sunrise
Please DO NOT use this version in production, it is an early test version.
For upgrade notes please visit:
https://github.com/php/php-src/blob/php-8.6.0alpha1/UPGRADING
Changelog: https://github.com/php/php-src/blob/php-8.6.0alpha1/NEWS
security/libsodium: Update to 1.0.21
The API remains compatible but bumping all dependent ports as SHLIB
has changed.
Changelog: https://github.com/jedisct1/libsodium/releases/tag/1.0.21-RELEASE
Security: https://00f.net/2025/12/30/libsodium-vulnerability/
PR: 279347
www/glpi: Update 11.0.0 => 11.0.1
No CVEs involved, only a couple of bug fixes related to features
introduced in 11.0.0.
ChangeLog:
https://github.com/glpi-project/glpi/releases/tag/11.0.1
PR: 290134
www/glpi: update to 10.0.17
This is a patch release of www/glpi from 10.0.16 to 10.0.17.
This is a security release (1 critical, 6 high severity, 5 moderate
security fixes).
Changelog: https://github.com/glpi-project/glpi/releases/tag/10.0.17
PR: 283104
MFH: 2024Q4
www/glpi: update to 10.0.15 (CVE-2024-31456, CVE-2024-29889)
Mostly a security release (2 high severity security fixes).
ChangeLog:
https://github.com/glpi-project/glpi/releases/tag/10.0.15
This release fixes a few security issues that have been recently discovered.
Update is recommended!
You will find below the list of security issues fixed in this bugfixes version:
* [SECURITY - high] Authenticated SQL injection from map search (CVE-2024-31456)
* [SECURITY - high] Account takeover via SQL Injection in saved searches feature
(CVE-2024-29889)
Also, here is a short list of main changes done in this version:
* [FIX] Fix used right by reservation form.
* [FIX] Do not rely on input to apply rules rights.
* [FIX] Always store updated SMTP Oauth refresh token.
* [TASK] Upgrade tinymce.
PR: 278641
MFH: 2024Q2
www/glpi: update to 10.0.14
This is a security release (11 security fixes including 3 high severity).
Changelogs:
- https://github.com/glpi-project/glpi/releases/tag/10.0.11
- https://github.com/glpi-project/glpi/releases/tag/10.0.12
- https://github.com/glpi-project/glpi/releases/tag/10.0.13
- https://github.com/glpi-project/glpi/releases/tag/10.0.14
PR: 278090
www/glpi: Security Update to 10.0.7
ChangeLog: https://github.com/glpi-project/glpi/releases/tag/10.0.7
* [SECURITY - High] SQL injection and Stored XSS via inventory agent request
* [SECURITY - High] Account takeover by authenticated user
* [SECURITY - High] SQL injection through dynamic reports
* [SECURITY - Moderate] Stored XSS through dashboard administration
* [SECURITY - Moderate] Stored XSS on external links
* [SECURITY - Moderate] Reflected XSS in search pages
* [SECURITY - Moderate] Privilege Escalation from technician to super-admin
* [SECURITY - Low] Blind Server-Side Request Forgery
* [SECURITY] Optional GLPI router to be able to use a safer web server root
directory.
* [FEATURE] Support of SMTP OAuth authentication.
* [FEATURE] Improved inventory file upload feature.
* [FIX] Many fixes and improvements on native inventory.
* [FIX] Some bugs on PHP 8.2.
* [FIX] Caching issues on entities.
* [FIX] Boolean FullText operator not working on knowledge base search.
* [FIX] Unexpected search results when using negative condition on ticket
actors.
* [FIX] Issues with LDAP filters/DN.
* [FIX] Unexpected results when searching on knowledge base categories.
PR: 271286
Reported by: mathias@monnerville.com (maintainer)
Security: CVE-2023-28632
CVE-2023-28633
CVE-2023-28634
CVE-2023-28636
CVE-2023-28639
CVE-2023-28838
CVE-2023-28849
CVE-2023-28852
*/*: Remove merged or non-existent USE_PHP directives
- Remove USE_PHP=hash which is available in default php installation of
all versions of php
* security/pear-Horde_Crypt_Blowfish: Remove OPTION MHASH
- Remove USE_PHP=json which is available in default php installation of
all versions of php
* devel/pear-PHPTAL: Remove OPTION JSON
* www/ilias: Remove OPTION SCORM2004
- Remove USE_PHP=mssql which is no longer available in php from php80
and later and has been replaced with sqlsrv module which is Windows
only
* www/codeigniter: Remove OPTION MSSQL
* www/moodle311: Remove OPTION MSSQL
* www/moodle39: Remove OPTION MSSQL
* www/moodle40: Remove OPTION MSSQL
* www/moodle41: Remove OPTION MSSQL
- Remove USE_PHP=openssl which is available in default php installation
of all versions of php
* databases/phpmyadmin: Remove OPTION OPENSSL
* databases/phpmyadmin5: Remove OPTION OPENSSL
* security/pear-Horde_Crypt_Blowfish: Remove OPTION OPENSSL
* www/nextcloud: Remove OPTION SSL
* www/owncloud: Remove OPTION SSL
- Remove USE_PHP=pcre which is available in default php installation of
all versions of php
* sysutils/racktables: Remove OPTION PCRE
- Remove USE_PHP=postgresql which should be USE_PHP=pgsql and update
following ports
* www/typo3-11
* www/typo3-12
- Remove USE_PHP=pdf which is no longer available as php module
* databases/phpmyadmin: Remove OPTION PDF
- Remove USE_PHP=spl which is available in default php installation of
all versions of php
- Remove USE_PHP=sqlsrv which was never imported into FreeBSD as that is
Windows only php module
* www/typo3-11: Remove OPTION SQLSRV
* www/typo3-12: Remove OPTION SQLSRV
- Bump where DEFAULT OPTIONS are affected
Sponsored by: Bounce Experts
Approved by: portmgr(blanket)
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
www/glpi: Ignore with php80
- Requires sodium extension which is not available in php80
- Pet portclippy and portfmt
PR: 260595
Reported by: portmgr (exp-run)
Approved by: portmgr (infrastructure blanket)
Sponsored by: Bounce Experts
Mark ports to IGNORE with new php81
- Mark some additional ports to IGNORE with the upcoming php DEFAULT
php80 [1]
PR: 260595 [1]
Reported by: portmgr (exp-run) [1]
Approved by: portmgr (infrastructure blanket)
Sponsored by: Bounce Experts
In order to switch to PHP 7.4 as new default, we need to ignore some ports. These are relying on the wddx module of PHP, which was removed in 7.4.
Therefore the following ports are marked as IGNORE_WITH_PHP= 74
* www/glpi
* www/zend-framework
* www/zend-framework1
PR: 248074
Sponsored by: Bounce Experts
www/glpi: Add dom to PHP dependency list
Without the extension the port is not functional
PR: 220842
Reported by: dasti <stievenard.david@gmail.com>
MFH: 2017Q3
www/glpi: Add curl to PHP dependency list
Without the extension the port is not functional
PR: 220842
Reported by: dasti <stievenard.david@gmail.com>
MFH: 2017Q3
www/glpi: Update version 0.90.3 => 0.90.5 and change option defaults
Per request [1], the IMAP and LDAP options have been set to ON by default.
The maintainer took the opportunity to upgrade the version [2].
I converted the options to their modern equivalents and made the
MASTER_SITES definition more generic to help future upgrades.
PR: 211862 [1]
Submitted by: David Stievenard
PR: 212222 [2]
Submitted by: maintainer
www/glpi: 0.85.2 -> 0.90.3
- 0.90.3:
http://www.glpi-project.org/spip.php?page=annonce&id_breve=358&lang=en
https://github.com/glpi-project/glpi/issues?q=milestone:0.90.3
- At the announcement older changelogs and announcements can be found
PR: 209663
Submitted by: fgudin+fbsd@bsdbellule.fr
Approved by: mathias@monnerville.com (maintainer timeout)