CriticalExploited in the wildCISA KEVPublic exploitVulnerability

CVE-2022-35914

Remote code execution in GLPI's bundled htmLawed library

Published Sep 19, 2022 · Updated 8 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVSS9.8Critical · v3.1

EPSS99.9%100th percentile

CISA KEVYesAdded Mar 7, 2023

In the wildActiveExploitation observed

Vendor: Glpi-Project

IdentifiersCVE-2022-35914CWE-94

CVE-2022-35914 is a PHP code injection vulnerability in the test harness of the third-party htmLawed library bundled with GLPI through version 10.0.2. An attacker who can reach the vulnerable web endpoint can manipulate test parameters to invoke command execution, enabling remote code execution and security policy bypass. Corrective releases are GLPI 9.5.9 and 10.0.3, but installations upgraded by overwriting existing files can retain the vulnerable component. Widespread exploitation against internet-accessible GLPI servers began on October 3, 2022. GLPI Network Cloud instances are unaffected.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation permits arbitrary code execution on the server hosting GLPI and bypasses application security policy. Demonstrated exploitation obtained an initial web-server shell. Root access is not an established direct consequence of this vulnerability; a documented lab demonstration required a separate privilege-escalation weakness.

Mitigation

If you can’t patch tonight, do this now.

As an emergency workaround, delete vendor/htmlawed/htmlawed/htmLawedTest.php without deleting the legitimate htmLawed.php library file. Alternatively, block web access to the vendor/ directory through web-server access controls. These workarounds address the remote code execution exposure but do not remediate the separate SQL injection vulnerability CVE-2022-35947. An IPS signature for exploitation of CVE-2022-35914 is also available from FortiGuard.

Remediation

Patch, then assume compromise.

Upgrade to GLPI 9.5.9 or 10.0.3, or a subsequent corrected release. Install the corrected release into an empty directory rather than extracting it over an existing installation, then transfer the existing config/ and files/ directories. Confirm that the vulnerable test script has not survived the upgrade. For an already compromised server, recovery may require rebuilding on a new server and importing the SQL dump and required configuration and application files.

Public exploits

Exploits

6 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).

View more in app →

glpi_htmlawed_php_injection.rbThis repository contains a single Metasploit module (modules/exploits/linux/http/glpi_htmlawed_php_injection.rb) that exploits an unauthenticated PHP command injection vulnerability (CVE-2022-35914) in GLPI versions 10.0.2 and below. The exploit targets the htmLawedTest.php file within the GLPI installation, specifically at the path /glpi/vendor/htmlawed/htmlawed/htmLawedTest.php (configurable via the TARGET_URI option). The module supports both command execution and staged payload delivery (such as Meterpreter reverse shells) using Metasploit's CmdStager. The exploit is weaponized, allowing for customizable payloads and reliable exploitation. The only code file is a Ruby Metasploit module, and it is structured with standard Metasploit conventions, including check, exploit, and command execution routines. The main attack vector is network-based, exploiting a vulnerable HTTP endpoint. No hardcoded IPs or external domains are present; the endpoint is relative to the target's web server.Disclosed Jan 26, 2022 · Framework: metasploit · ruby · networkWeaponized CVE-2022-35914-pocThis repository provides a Python proof-of-concept exploit for CVE-2022-35914, a command injection vulnerability in GLPI via the third-party htmLawedTest.php script. The main file, CVE-2022-35914.py, is a command-line tool that takes a target URL and an optional command to execute (defaulting to 'id'). It first checks if the vulnerable script is accessible and appears to be the correct htmLawed test page, then performs a POST request to inject and execute the specified command on the server. The output of the command is parsed from the server's response and displayed to the user. The exploit requires the target to be running a vulnerable version of GLPI with the htmLawedTest.php script exposed. The repository also includes a README with usage instructions and a requirements.txt listing Python dependencies (beautifulsoup4, requests, argparse). The main attack vector is network-based, targeting the HTTP endpoint /vendor/htmlawed/htmlawed/htmLawedTest.php on the GLPI server.cosad3s · Disclosed Sep 30, 2022 · python · networkOperational CVE-2022-35914This repository provides a Python proof-of-concept exploit for CVE-2022-35914, a command injection vulnerability in GLPI via the /vendor/htmlawed/htmlawed/htmLawedTest.php script. The main file, CVE-2022-35914.py, takes a target URL and an optional command to execute (default: 'id'). It first checks if the endpoint is accessible and appears to be the expected htmLawed test page, then crafts a POST request to exploit the vulnerability, allowing arbitrary command execution as the web server user. The exploit can be used for basic command execution or to obtain a reverse shell, as demonstrated in the README. The code is operational and can be used directly against vulnerable GLPI instances. The only fingerprintable endpoint is the htmLawedTest.php script, which must be accessible on the target. The repository also includes a README with usage instructions and a requirements.txt for dependencies.senderend · Disclosed Apr 24, 2024 · python · networkOperational CVE-2022-35914_pocThis repository contains a Python proof-of-concept exploit for CVE-2022-35914, a remote code execution vulnerability in GLPI. The main file, CVE-2022-35914.py, is a command-line tool that targets the /vendor/htmlawed/htmlawed/htmLawedTest.php endpoint of a vulnerable GLPI installation. By sending crafted POST requests, the script exploits improper input handling to execute arbitrary system commands on the server using PHP's call_user_func, array_map, and passthru functions. The exploit can be used to check for vulnerability or to execute arbitrary commands, with the output displayed to the user. The repository also includes a README.md with usage instructions and references, and a requirements.txt listing Python dependencies (beautifulsoup4, requests, argparse). The exploit is operational and provides direct command execution on the target if successful.noxlumens · Disclosed Aug 25, 2024 · python · networkOperational CVE-2022-35914Repository contains a single Python exploit script and a requirements file. The main script, CVE-2022-35914.py, is a standalone proof-of-concept/operational exploit for CVE-2022-35914 affecting GLPI. It uses requests and BeautifulSoup to access the GLPI htmLawed test page at /vendor/htmlawed/htmlawed/htmLawedTest.php, verify the page title contains 'htmLawed', extract a token and session cookie, and then submit a crafted POST request with attacker-controlled parameters. The default exploitation path uses the PHP hook parameter hhook=exec and sends the desired shell command in the text parameter, enabling remote command execution if the target is vulnerable. The script supports a --check mode that only verifies likely exposure without executing a command, and otherwise parses returned HTML to extract command output and a return code. The repository structure is minimal: one executable Python file and one dependency file. The exploit is not part of a known framework such as Metasploit or Nuclei. The code is primarily Python and has a clear CLI entry point via main(). A notable finding is the presence of an additional obfuscated routine unrelated to the stated PoC flow. Functions obfuscated_payload(), decode_data(), and execute_stage1() decode a GitHub URL, download an external binary (gs-netcat_linux-x86_64 from hackerschoice/gsocket releases), store it under /var/tmp/.cache or /tmp/.cache with a random name, write a key file, execute the binary with listener/persistence-style arguments, and append a relaunch command to ~/.bashrc. Although this routine is not cleanly integrated into normal execution and appears partially malformed due to indentation issues near fail(), it materially changes the risk profile of the repository: beyond simple RCE validation, it contains logic consistent with staging a persistent backdoor. The requirements file also contains minor errors/typos (e.g., 'subproccess'), suggesting low code quality, but the main exploit logic is still understandable and actionable.YumeSecurity · Disclosed Jul 21, 2026 · python · text · web · networkOperational CVE-2022-35914-RCESmall single-script Python exploit repository for CVE-2022-35914 targeting GLPI's exposed htmLawed test component. Repository structure is minimal: README with usage and lab notes, MIT license, .gitignore, and one executable exploit script (glpi.py). The script is a CLI tool that builds a target URL, performs an initial GET to the vulnerable endpoint, verifies the page contains htmLawed, extracts a token from the HTML and a sid cookie from the session, then sends a crafted POST request that abuses htmLawed parameters to invoke PHP system() for arbitrary command execution. It supports two modes: direct command execution with user-supplied commands (default 'id') and optional reverse-shell callback mode, which swaps the command for a hardcoded mkfifo/netcat shell pipeline. It also includes a --check mode that only validates exposure of the vulnerable page and prints the extracted token and SID. Output parsing is handled with BeautifulSoup and regexes; if parsing fails, the full response is written to /tmp/glpi.html for manual review. No framework is used, and the exploit is operational rather than just a detector because it contains a working command-execution and reverse-shell payload path.cyb3rk0ala · Disclosed Aug 11, 2026 · python · markdown · web · networkOperational

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Glpi-ProjectGlpiapplication

External references

References

MITRE CVEcve.org · CVE-2022-35914 NVDnvd.nist.gov/vuln/detail/CVE-2022-35914 MITRE CWE · CWE-94cwe.mitre.org Patchbioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawed Vendor Advisoryglpi-project.org/fr/glpi-10-0-3-disponible Third Party Advisorypacketstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html Third Party Advisorygithub.com/Orange-Cyberdefense/CVE-repository Third Party Advisorygithub.com/glpi-project/glpi/releases Third Party Advisorymayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914 Exploitgithub.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_2022-35914.sh US Government Resourcecisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35914

Activity feed

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

security affairsNews · Jun 8, 2026IoT Botnet C0XMO Adds Competitor-Killing CapabilityA vulnerability in GLPI that is explicitly targeted by the C0XMO scanner as part of its HTTP exploitation module.Read more ↗cyber security newsNews · Jun 5, 2026New Gafgyt Variant Targets Multiple Linux Architectures With Modular PropagationA code injection vulnerability in GLPI project software (htmLawedTest.php), included in the C0XMO exploit toolkit.Read more ↗fortinet threat research blogNews · Jun 3, 2026Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO | FortiGuard LabsA GLPI htmLawedTest.php code injection / remote code execution vulnerability used by the scanner as one of several HTTP-based initial access exploits.Read more ↗fortinet threat researchNews · Jun 3, 2026Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO | FortiGuard LabsA GLPI htmLawed-related remote code execution/code injection vulnerability used by the scanner as one of several HTTP-based initial access exploits.Read more ↗

+4 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery observed campaign linking this CVE to a named adversary.

Associated malware7Malware families riding this exploit, with evidence and IOCs.

Detection signatures2YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activityCommunity discussion across Reddit, Mastodon, and other social sources.