Releases: glpi-project/glpi
11.0.1
Following the major release of GLPI 11, here is the first bugfixes version, correcting most of reported issues.
We will continue to fix the remaining reported issues in the coming weeks. In the meantime if you experience an issue, feel free to check if there is already a report and make one if not so that it can be addressed.
You can download the GLPI 11.0.1 archive on GitHub.
Also, here is a short list of important bugfixes done in this version:
- Revert auto association of a technician with a ticket if he is assigned a ticket task #21232
- Fix secured Inventory endpoint when HLAPI is disabled #21238
- Dashboard not saving correctly after changes #21239
- Search page display issues on sort/default search #21147
- Add missing information on define itemtype rules for Network Equipments #21271
Many bug fixes have been made, read the full changelog is available for more details.
The full changelog is available for more details.
We would like to thank all people who contributed to this new version and all those who contributes regularly to the GLPI project!
Regards.
11.0.0

We are proud to announce the official release of GLPI 11, the latest major version of our open-source software. After months of development and community testing, GLPI 11 is now stable and ready for production.
Here is a short video introduction for this release
What’s new ?
While the full list of changes can be found in the detailed changelog, here are some of the most important highlights:
- 📦 Native custom assets: Create any type of assets to be included in the first menu, adapt theirs behaviors and their fields
- 📝 Integrated forms: With a new interactive editor, create pretty forms for your technicians and end-users.
- 🛎️ New self-service portal: Help your users to discover the services you offer.
- 🛡️ 2FA: Strengthen the authentication to GLPI
- ⚡ Webhooks: Triggers HTTP calls to external applications
- and more…
Get Started with GLPI 11 Today
You can download the new stable release here:
Documentation has also been updated to guide you through the upgrade process and help you make the most of GLPI 11.
What’s Next?
In the coming months, we’ll continue to:
- Monitor feedback and release patches when needed.
- Expand integrations and plugins to enrich the ecosystem.
- Explore new innovations to keep GLPI a modern, reliable ITSM platform.
A huge thank you to our community for their contributions in testing, translating, all the help given to complete this version.
11.0.0-rc5
10.0.20
You can download the GLPI 10.0.20 archive on GitHub.
Many bug fixes have been made, read the full changelog is available for more details.
We would like to thank all people who contributed to this new version and all those who contributes regularly to the GLPI project!
Regards.
11.0.0-rc4
11.0.0-rc3
11.0.0-rc2
11.0.0-rc1
10.0.19
This is a security release, upgrading is recommended
This release fixes a few security issues that have been recently discovered. Update is recommended!
You can download the GLPI 10.0.19 archive on GitHub.
You will find below the list of security issues fixed in this bugfixes version:
- [SECURITY - MODERATE] Stored XSS on projects kanban (CVE-2025-27514)
- [SECURITY - LOW] Blind SSRF in RSS feeds and planning (CVE-2025-52567)
- [SECURITY - MODERATE] XSS and open redirection in planning (CVE-2025-52897)
- [SECURITY - MODERATE] Mail receiver credentials exfiltration (CVE-2025-53008)
- [SECURITY - MODERATE] Reservations modification by unauthorized user (CVE-2025-53357)
- [SECURITY - LOW] Access to unallowed items information through external links (CVE-2025-53113)
- [SECURITY - MODERATE] Data exposure to non allowed users (CVE-2025-53111)
- [SECURITY - MODERATE] Data removal from allowed users (CVE-2025-53112)
- [SECURITY - HIGH] Unauthorized rules execution order update (CVE-2025-53105)
Many bug fixes have also been made, read the full changelog is available for more details.
We would like to thank all people who contributed to this new version and all those who contributes regularly to the GLPI project!
Regards.
10.0.18
This is a security release, upgrading is recommended
This release fixes a few security issues that have been recently discovered. Update is recommended!
You can download the GLPI 10.0.18 archive on GitHub.
You will find below the list of security issues fixed in this bugfixes version:
- [SECURITY - High] Unauthenticated SQL injection through the inventory endpoint (CVE-2025-24799)
- [SECURITY - High] Authenticated Remote code execution (CVE-2025-24801)
- [SECURITY - High] SQL injection through the rules configuration (CVE-2025-21619)
- [SECURITY - Moderate] Open Redirection (CVE-2024-11955)
- [SECURITY - Moderate] Reflected XSS in search page (CVE-2025-21627)
- [SECURITY - Moderate] Exposure of sensitive information in the
status.php
endpoint (CVE-2025-21626) - [SECURITY - Moderate] Plugins disabled by unauthenticated user (CVE-2025-23024)
- [SECURITY - Moderate] Unauthorized authentication by email using the OAuthIMAP plugin (CVE-2025-23046)
- [SECURITY - Moderate] Unauthorized access to debug mode (CVE-2025-25192)
Many bug fixes have also been made, read the full changelog is available for more details.
We would like to thank all people who contributed to this new version and all those who contributes regularly to the GLPI project!
Regards.