Glpi CVE-2026-26027

GLPI versions 11.0.0 through 11.0.5. Unauthenticated attacker stores XSS payload via inventory endpoint. Victim must visit page displaying stored payload in browser. Requires user interaction (UI:R) to trigger XSS execution.

CVSS 7.5 High severity reflects the unauthenticated attack surface (AV:N/PR:N) enabling external threat actors to inject persistent malicious payloads, though High attack complexity (AC:H) and required user interaction (UI:R) provide some friction. The stored XSS nature allows attackers to achieve High impact across Confidentiality, Integrity, and Availability (C:H/I:H/A:H) by stealing admin session tokens, modifying CMDB data, or performing actions as privileged users. No EPSS score provided, but the combination of unauthenticated access and stored XSS typically drives exploitation interest. No CISA KEV listing indicates no confirmed active exploitation campaigns at analysis time. No public exploit identified at time of analysis, reducing immediate weaponization risk. Real-world risk depends heavily on deployment architecture: internet-facing GLPI instances with open inventory endpoints face elevated exposure, while internal-only deployments behind VPNs have reduced attack surface. Organizations using automated inventory agents from untrusted networks should prioritize patching. The High attack complexity suggests exploitation requires precise conditions (potentially specific inventory data formats or timing), but stored XSS payloads persist indefinitely once successfully injected, making this a medium-to-high priority for patch deployment especially in multi-tenant or externally accessible environments.

An external attacker identifies an internet-accessible GLPI 11.0.4 instance used by an organization for IT asset tracking. Without authentication, the attacker crafts a malicious HTTP request to the inventory endpoint containing a JavaScript payload disguised as legitimate asset metadata (e.g., in computer name or serial number fields). The payload includes code to exfiltrate session cookies to an attacker-controlled server. GLPI stores this malicious inventory record in its database. When an administrator or helpdesk technician subsequently views the inventory dashboard or asset details page, the stored XSS executes in their browser context, stealing their authenticated session token. The attacker uses the hijacked admin session to access sensitive CMDB data, modify asset configurations, or create backdoor administrator accounts for persistent access to the IT management system.