CVE-2013-2225: inc/ticket.class.php in GLPI 0.83.9 and earlier allows remote attackers to unserialize arbitrary PHP object...

Security readout for executives and security teams

GLPI 0.83.9 and earlier can process untrusted ticket-form input as serialized PHP objects. That is a dangerous class of bug because impact depends on application code available to the attacker. The public sources confirm the vulnerable parameter and affected versions, but do not provide CVSS, confirmed business impact, or active exploitation evidence. Exposure is limited to organizations still running GLPI 0.83.9 or earlier, especially if the ticket form is reachable by untrusted users. The bundle does not identify affected CPEs, deployment defaults, or authentication requirements. Treat this as a legacy application remediation item with meaningful risk if GLPI is internet-facing. The absence of CVSS and KEV lowers confidence, but public exploit material and unsafe deserialization justify timely upgrade or access restriction. Mitigation focus: Inventory GLPI deployments and identify any version 0.83.9 or earlier.; Review GLPI vendor guidance and the referenced upstream diff for the official fix path.; Upgrade affected GLPI instances to a supported fixed release..

Prepared

Jun 14, 2026, 07:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.