GLPI CVE-2026-53610

Exploitation requires an attacker to lure an already-authenticated GLPI user (11.0.0 through 11.0.7) into opening a specially crafted dashboard URL whose parameter is reflected into a widget's markup (e.g., the article-list item's title attribute) without HTML encoding. Limiting factors: the payload only executes in the victim's browser session (reflected, not stored), mandatory user interaction is required (UI:A) plus the CVSS-noted attack requirement (AT:P), the victim must be a valid GLPI user with access to render the dashboard, and instances upgraded to 11.0.8 are not affected. No server-side privileges are needed by the attacker to craft the URL (PR:N).

This is a reflected cross-site scripting flaw (CWE-79) in the GLPI dashboard, rated CVSS 4.0 7.5 by the vendor/NVD (AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H). The attack is network-reachable and requires no attacker authentication (PR:N), but it is fundamentally client-side: the vector carries AT:P (a present attack requirement) and UI:A (the victim must actively open a crafted URL), so exploitation depends on social-engineering a logged-in GLPI user rather than a self-contained remote compromise. No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied intelligence, so exploitation status is 'no public exploit identified at time of analysis' - active exploitation is neither claimed nor confirmed. The VC:H/VI:H/VA:H impact rating in the CVSS 4.0 vector appears overstated for a reflected XSS bug: script execution is confined to the victim's authenticated browser session, so realistic impact is limited (session/action hijacking in the victim's context), which I reflect in my own lower assessed vectors. Net: a legitimate patch-worthy issue, but a phishing-dependent, medium-priority XSS rather than a widescale unauthenticated RCE - prioritize routine patching, not emergency response, absent evidence of exploitation.

An attacker crafts a GLPI dashboard URL embedding malicious markup in a parameter that is reflected into a widget's HTML (e.g., the article-list item title attribute) without output encoding, then sends it to a logged-in GLPI user via email or chat. When the victim opens the link, the injected JavaScript executes in their authenticated session, allowing the attacker to perform actions as that user or steal session context. No public proof-of-concept is referenced in the available data.