Free IT and asset management software
# pkg install glpiinstalls 11.0.1_1,1 from latest; from quarterly (2026Q4) 11.0.1_1,1# cd /usr/ports/www/glpi && make install clean# make -C /usr/ports/www/glpi config # change options first
First time installation notes:
Before using GLPI, you will need to configure your database.
Full installation instructions are available here:
http://glpi-project.org/spip.php?article61
If you are using MySQL, here's the short version of the instructions:
1. Create a new database:
$ mysqladmin -uroot create glpi
2. Grant access to the database:
$ mysql -uroot -e"GRANT ALL ON glpi.* TO USERNAME@localhost IDENTIFIED BY 'PASSWORD'" glpi
(choose your own values for USERNAME and PASSWORD)
Make sure Apache supports PHP (www/mod_php5) and add a config file for
GLPI in Includes/glpi.conf:
Alias /glpi /usr/local/www/glpi
<Directory /usr/local/www/glpi>
AllowOverride Options FileInfo Limit
Options Indexes FollowSymLinks
Require all granted
DirectoryIndex index.php
</Directory>
Then reload Apache: 'apachectl graceful'
Please visit 'http://{host.domain}/glpi/' in a
web-browser and follow the configuration instructions.| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 11.0.1_1,1 | 11.0.1_1,1 | – |
| FreeBSD 15 | 11.0.1_1,1 | 11.0.1_1,1 | – |
| FreeBSD 14 | 11.0.1_1,1 | 11.0.1_1,1 | 11.0.1_1,1 |
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 11.0.1_1,1 | 11.0.1_1,1 | – |
| FreeBSD 14 | 11.0.1_1,1 | 11.0.1_1,1 | 11.0.1_1,1 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
The CVE record lists the packaged version 11.0.1_1,1 as affected, and no VuXML entry names the CVE. What does this mean?
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-48482 | 9.4 | 2026-09-25 | GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifi… |
| CVE-2026-26026 | 9.1 | 2026-04-06 | GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in… |
| CVE-2026-47679 | 8.5 | 2026-09-25 | GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the pr… |
| CVE-2026-5385 | 8.4 | 2026-06-02 | An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item. This issue affects glpi: before 11.0.7. |
| CVE-2026-26263 | 8.1 | 2026-04-06 | GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based blind SQL injection exists in GLPI's Search engine. … |
| CVE-2026-22248 | 8.1 | 2026-03-11 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. From 11.0.0 to before … |
| CVE-2026-49470 | 7.7 | 2026-09-25 | GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissio… |
| CVE-2026-53625 | 7.5 | 2026-09-25 | GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change ano… |
| CVE-2026-53610 | 7.5 | 2026-09-25 | GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup w… |
| CVE-2026-26027 | 7.5 | 2026-04-06 | GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. T… |
| CVE-2025-66417 | 7.5 | 2026-01-15 | GLPI is a free asset and IT management software package. From 11.0.0, < 11.0.3, an unauthenticated user can perform a SQL injection through the inventory endpoint. This … |
| CVE-2025-64516 | 7.5 | 2026-01-15 | GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset,… |
| CVE-2026-29047 | 7.2 | 2026-04-06 | GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, an authenticated user can perform a SQL injection via the logs export … |
| CVE-2026-53629 | 7.1 | 2026-09-25 | GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab… |
| CVE-2026-40108 | 7.1 | 2026-06-02 | GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, a technician can store an XSS payload in a ITIL costs. This issue has been fi… |
| CVE-2026-42318 | 7.0 | 2026-06-03 | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 10.0.25 and 11.0.7, low privilege users with access to planning … |
| CVE-2026-42317 | 7.0 | 2026-06-03 | GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, a technician can delete arbitrary files from … |
| CVE-2026-44281 | 7.0 | 2026-06-03 | GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, an authenticated user with config READ permis… |
| CVE-2026-25937 | 6.5 | 2026-03-17 | GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's credentials… |
| CVE-2026-25936 | 6.5 | 2026-03-17 | GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can perfom a SQL injection. Versio… |
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-53627 | 6.0 | 2026-09-25 | GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operati… |
| CVE-2026-53628 | 5.9 | 2026-09-25 | GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2… |
| CVE-2026-42320 | 5.9 | 2026-06-03 | GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 10.0.25 and 11.0.7, a technician can read arbitrary files inside … |
| CVE-2026-108726 | 5.3 | 2026-10-11 | GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by… |
| CVE-2026-55217 | 5.3 | 2026-09-25 | GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge … |
| CVE-2026-45801 | 5.3 | 2026-09-25 | GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode.… |
| CVE-2026-32312 | 5.1 | 2026-05-19 | GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, an authenticated user with forms READ permission can export the structure of … |
| CVE-2026-49469 | 4.6 | 2026-09-25 | GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through … |
| CVE-2026-23624 | 4.3 | 2026-02-04 | GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used, based on… |
| CVE-2026-22247 | 4.1 | 2026-02-04 | GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLPI administrator can perform SSRF request through the Webhook feature.… |
Listed in VuXML, the packaged version 11.0.1_1,1 is still in the affected range; pkg audit reports it. What does this mean?
CVE-2024-11955, CVE-2025-21619, CVE-2025-21626, CVE-2025-21627, CVE-2025-23024, CVE-2025-23046, CVE-2025-24799, CVE-2025-24801, CVE-2025-25192
CVE-2024-27096, CVE-2024-27098, CVE-2024-27104, CVE-2024-27914, CVE-2024-27930, CVE-2024-27937
CVE-2023-28632, CVE-2023-28634, CVE-2023-28636, CVE-2023-28639, CVE-2023-28838, CVE-2023-28849, CVE-2023-28852
no CVE referenced
Add NO_STAGE all over the place in preparation for the staging support (cat: www)85fbf21ec5
- Update to 0.83.8 Changes: https://forge.indepnet.net/projects/glpi/versions/866 PR: ports/178258 Submitted by: Mathias Monnerville <mathias@monnerville.com> (maintainer)084f15fc00
- Update to 0.83.7 PR: 176101 Submitted by: Mathias Monnerville <mathias@monnerville.com> (maintainer)924986e64d
- update to 0.83.5, adopt optionsNG - while here pet portlint PR: 172788 Submitted by: maintainer, mathias@monnerville.com Feature safe: yese33759adb4
- Update to 0.83.4 PR: ports/170818 Submitted by: Mathias Monnerville <mathias _AT_ monnerville.com>d118a66e4c
- Update to 0.80.7 PR: ports/165203 Submitted by: Mathias Monnerville <mathias [AT] monnerville.com> (maintainer)92de5ae736
- Update to 0.80.2 due to CVE-2011-2720 PR: ports/164904 Submitted by: Mathias Monnerville <mathias _AT_ monnerville.com> (maintainer)6c943e9c33
Update to 0.80.2 PR: ports/160841 Submitted by: Mathias Monnerville <mathias@monnerville.com> (maintainer)f0aeaaaf4f
- Add mbstring dependency - Add options ldap and imap support PR: ports/158795 Submitted by: Gvozdikov Veniamin <g.veniamin _AT_ googlemail.com> Approved by: maintainer79638c4def
- Update to 0.78.1 PR: ports/152782 Submitted by: Mathias Monnerville <mathias AT monnerville.com>35e2aca0bc
- Update to 0.72.4 PR: 144783 Submitted by: Mathias Monnerville <mathias@monnerville.com> (maintainer)69c032bdc1
- Add php5-json dependency - Bump PORTREVISION PR: ports/142364 Submitted by: Serg <mail_of_sergey mail.ru> Approved by: maintainer387a26c09d
- Update to 0.72.3 - Changelog at <http://www.glpi-project.org/spip.php?page=annonce&id_breve=183&lang=en> PR: ports/140085 Submitted by: Mathias Monnerville <mathias _AT_ monnerville.com> (maintainer)c74bfcd57a
- Update to 0.72.2 PR: ports/138608 Submitted by: Mathias Monnerville <mathias monnerville.com>ad637f4551
- Update to 0.72 PR: ports/136990 Submitted by: Mathias Monnerville <mathias monnerville.com> (maintainer)1c163031e1
- Update to 0.71.6 PR: ports/136241 Submitted by: Mathias Monnerville <mathias monnerville.com> (maintainer)00c9092ea4
- Update to 0.71.5 See: http://www.glpi-project.org/spip.php?page=annonce&id_breve=163&lang=en PR: ports/131076 Submitted by: Mathias Monnerville <mathias@monnerville.com> (maintainer)452bf1a34b
- update to 0.71.4 PR: ports/131011 Submitted by: Mathias Monnerville <mathias@monnerville.com> (maintainer) Security: http://www.vuxml.org/freebsd/2ffb1b0d-ecf5-11dd-abae-00219b0fc4d8.html8a4466c6cd
- GLPI upgrade to 0.71.3 PR: ports/129387 Submitted by: Mathias Monnerville <mathias@monnerville.com> (maintainer)8d1b807eac
- Update to 0.71.2 PR: 127622 Submitted by: Mathias Monnerville <mathias@monnerville.com> (maintainer)18c3968b44
- Update to 0.71 PR: ports/125615 Submitted by: Mathias Monnerville <mathias@monnerville.com> (maintainer)983bf81eb4
- Update to 0.70.2 PR: ports/124429 Submitter: maintainera7d70a05f6
- Update to 0.70.1.a PR: 119889 Submitted by: Mathias Monnerville <mathias@monnerville.com> (maintainer)e717fabce7
- Update to 0.70 PR: ports/119153 Submitted by: Mathias Monnerville <mathias (AT) monnerville.com>77d9ac7c98
- Update to 0.68.3.2 - Remove editor backup files PR: ports/115828 Submitted by: Mathias Monnerville <mathias.monnerville at paris-sorbonne.fr> (maintainer)e25dde754c
- WWWOWN and WWWGRP are defined in bsd.port.mk948c9e8cc4
- GLPI does not use gettext for i18n - Bump PORTREVISION PR: ports/109088 Submitted by: Mathias Monnerville <mathias at monnerville.com> (maintainer)9665be3aa1
GLPI is an Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company (computer, software, printers...). It has enhanced functions to make the daily life for the administrators easier, like a job- tracking-system with mail-notification and methods to build a database with basic information about your network-t WWW: http://glpi-project.org/ PR: ports/109055 Submitted by: Mathias Monnerville <mathias at monnerville.com>583eaf674c