Which versions of GLPI are affected by CVE-2026-42321?

GLPI versions 10.0.4-10.0.24 contain a stored cross-site scripting vulnerability (CVSS 8.4) with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-42321?

Within 24 hours: Inventory all GLPI deployments and document which instances run vulnerable versions (10.0.4-10.0.24). Within 7 days: Apply vendor patch to all affected systems. Within 30 days: Verify patch deployment completion and evaluate additional access controls for technician asset modifications.

GLPI CVE-2026-42321

Q: What is the CVSS score of CVE-2026-42321?

CVE-2026-42321 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34097 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-03 GitHub_M

XSS Glpi

8.4

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 03, 2026 - 18:30 vuln.today

Patch available

Jun 03, 2026 - 17:01 EUVD

CVSS changed

Jun 03, 2026 - 16:22 NVD

8.4 (HIGH)

CVE Published

Jun 03, 2026 - 15:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to version 10.0.25, a technician can store an XSS payload in the asset locked tab. Upgrade to 10.0.25 or 11.0.7 to receive a patch.

AnalysisAI

Stored cross-site scripting in GLPI 10.0.4 through 10.0.24 allows an authenticated technician to persist a malicious JavaScript payload in the asset locked tab, which executes in the browser of any subsequent user who views the affected asset. The flaw carries a CVSS 4.0 score of 8.4 driven by high impact on confidentiality, integrity, and availability of the victim session, though exploitation requires high privileges (technician role) and user interaction. No public exploit identified at time of analysis and SSVC reports no observed exploitation.

Technical ContextAI

GLPI is a widely deployed open-source IT service management and asset tracking platform written in PHP, used to inventory hardware, manage tickets, and track infrastructure. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied content stored in the asset 'locked' tab is rendered back into the GLPI web UI without sufficient HTML/JavaScript encoding. The affected CPE is cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:* covering the GLPI application across versions 10.0.4 up to but not including 10.0.25, with a parallel 11.x branch patched in 11.0.7.

RemediationAI

Vendor-released patch: upgrade to GLPI 10.0.25 on the 10.x branch or 11.0.7 on the 11.x branch as detailed in advisory GHSA-hwjc-8228-55x4 (https://github.com/glpi-project/glpi/security/advisories/GHSA-hwjc-8228-55x4). If patching must be deferred, restrict the technician role to trusted personnel and audit which accounts hold lock-management permissions on assets, since exploitation requires that privilege level; additionally, consider enforcing a strict Content Security Policy on the GLPI front-end to limit inline script execution, accepting that some legitimate UI scripts or plugins may break, and review recent locked-tab entries on critical assets for injected markup before applying the upgrade.