What is the CVSS score of CVE-2026-25932?

CVE-2026-25932 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Glpi are affected by CVE-2026-25932?

GLPI asset management software versions 0.60 through 10.0.23 contain a stored cross-site scripting vulnerability that allows authenticated technicians to inject malicious code into supplier records,…. A patch is available.

How to fix or mitigate CVE-2026-25932?

Within 24 hours: Identify all GLPI instances and document current versions. Within 7 days: Apply vendor patch to upgrade GLPI to version 10.0.24 or later across all affected systems. Within 30 days: Conduct access review of technician-level accounts and implement principle of least privilege to restrict supplier record modification to essential personnel only.

Glpi CVE-2026-25932

EUVD-2026-19245 HIGH

Improper Encoding or Escaping of Output (CWE-116)

2026-04-06 GitHub_M

XSS Glpi Glpi Project

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:06 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

10.0.24

EUVD ID Assigned

Apr 06, 2026 - 15:00 euvd

EUVD-2026-19245

Analysis Generated

Apr 06, 2026 - 15:00 vuln.today

CVE Published

Apr 06, 2026 - 14:31 nvd

HIGH 7.2

DescriptionGitHub Advisory

GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier fields. This vulnerability is fixed in 10.0.24.

AnalysisAI

Stored cross-site scripting (XSS) in GLPI asset management software allows authenticated technician-level users to inject malicious JavaScript into supplier fields, achieving code execution in victim browsers with high confidentiality, integrity, and availability impact. Affects GLPI versions 0.60 through 10.0.23, patched in version 10.0.24. EPSS data not available; no public exploit identified at time of analysis, and not listed in CISA KEV. The CVSS score of 7.2 reflects network-accessible attack requiring high privileges but no user interaction, making this a medium-priority issue for organizations running vulnerable GLPI instances with multiple technician accounts.

Technical ContextAI

GLPI (Gestion Libre de Parc Informatique) is an open-source IT asset management and helpdesk solution written in PHP. This vulnerability stems from improper encoding or escaping of output (CWE-116), specifically in the supplier management module where technician users can input data into supplier fields. The absence of proper output encoding allows JavaScript injection that persists in the database and executes when other users view the affected supplier records. The stored nature of this XSS makes it more severe than reflected XSS, as the payload remains active until removed and affects all users who view the compromised data. The vulnerability spans an exceptionally long version range from GLPI 0.60 (released circa 2007) through 10.0.23, indicating a long-standing input validation gap in the codebase. The affected product is identified by CPE cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*, confirming this affects the core GLPI application across platforms.

RemediationAI

Upgrade GLPI to version 10.0.24 or later, which contains input validation and output encoding fixes for the supplier field XSS vulnerability. The patch is available through standard GLPI update channels and the project's GitHub repository. Organizations should prioritize upgrading production instances and review supplier records for suspicious JavaScript content as stored payloads may persist after upgrade until the affected records are sanitized. If immediate patching is not feasible, implement compensating controls including restricting technician account access to the supplier management module, implementing web application firewall rules to detect XSS patterns in supplier field submissions, and monitoring for anomalous JavaScript in supplier data through database audits. Review access logs for technician accounts with supplier modification permissions to identify potential exploitation attempts. Full remediation details and upgrade instructions are available in the GitHub security advisory at https://github.com/glpi-project/glpi/security/advisories/GHSA-m627-945g-x7xh. No workaround fully mitigates the vulnerability; upgrading to 10.0.24 is the definitive solution.