What is the CVSS score of CVE-2026-26027?

CVE-2026-26027 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Glpi are affected by CVE-2026-26027?

GLPI versions 11.0.0 through 11.0.5 contain a stored cross-site scripting (XSS) vulnerability in the inventory endpoint that allows unauthenticated attackers to inject malicious scripts, creating…. A patch is available.

How to fix or mitigate CVE-2026-26027?

Within 24 hours: Identify all GLPI 11.0.x instances in your environment and document their network accessibility status. Within 7 days: Apply the vendor-released patch to advance all GLPI 11.0.x installations to version 11.0.6 or later, prioritizing publicly accessible instances. Within 30 days: Conduct a security audit of the inventory endpoint to verify the patch effectiveness and review logs for evidence of XSS injection attempts since deployment.

Glpi CVE-2026-26027

EUVD-2026-19247 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-06 GitHub_M

XSS Glpi Glpi Project

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:06 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

11.0.6

EUVD ID Assigned

Apr 06, 2026 - 15:00 euvd

EUVD-2026-19247

Analysis Generated

Apr 06, 2026 - 15:00 vuln.today

CVE Published

Apr 06, 2026 - 14:35 nvd

HIGH 7.5

DescriptionGitHub Advisory

GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. This vulnerability is fixed in 11.0.6.

AnalysisAI

Stored XSS in GLPI 11.0.0-11.0.5 allows remote attackers to inject malicious scripts via the inventory endpoint without authentication, leading to potential session hijacking and unauthorized actions when victims interact with poisoned inventory data. CVSS 7.5 (High) with Network attack vector and no privileges required (PR:N). No public exploit identified at time of analysis, though the unauthenticated nature and stored XSS persistence elevate practical risk for environments with publicly accessible GLPI installations.

Technical ContextAI

GLPI (Gestionnaire Libre de Parc Informatique) is an open-source IT asset management and helpdesk solution. This vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation) affecting the inventory endpoint in versions 11.0.0 through 11.0.5. The inventory endpoint, typically used for automated asset discovery and registration, fails to properly sanitize user-supplied input before storage and rendering. As a stored (persistent) XSS, malicious JavaScript payloads survive server-side storage in the inventory database and execute in the browsers of authenticated administrators or users who subsequently view the compromised inventory records. The unauthenticated write access (PR:N in CVSS vector) means external attackers can poison inventory data without credential requirements, though successful exploitation requires user interaction (UI:R) when victims access affected pages. The affected CPE cpe:2.3:a:glpi-project:glpi identifies the GLPI Project's core application as the vulnerable component.

RemediationAI

Immediately upgrade to GLPI version 11.0.6 or later, which contains the vendor-released patch addressing the inventory endpoint input validation flaw. Download patched releases from official GLPI Project channels at https://github.com/glpi-project/glpi/releases or via standard package management for your distribution. Review the GitHub Security Advisory at https://github.com/glpi-project/glpi/security/advisories/GHSA-chch-wcm9-f9cp for specific upgrade instructions and any additional mitigation guidance. As an interim workaround if immediate patching is not feasible, restrict network access to the inventory endpoint using firewall rules or web application firewall policies to permit only trusted IP ranges of legitimate inventory agents, though this does not eliminate risk from compromised internal systems. Post-upgrade, audit existing inventory records for suspicious JavaScript content that may have been injected during the vulnerability window, particularly examining recently added assets from untrusted sources. Implement web application firewall rules with XSS detection signatures as defense-in-depth, and ensure Content Security Policy headers are configured to limit script execution domains.