Which versions of GLPI are affected by CVE-2026-5385?

GLPI allows knowledge base content editors to inject malicious code that executes in the browsers of all organization members accessing affected documentation, enabling credential theft and account…. A patch is available.

How to fix or mitigate CVE-2026-5385?

Within 24 hours: Identify all GLPI instances and document their versions; restrict knowledge base editor access if patch deployment cannot complete within 48 hours. Within 7 days: Upgrade all GLPI instances to version 11.0.7 or later and review knowledge base modification logs for unauthorized or suspicious content additions. Within 30 days: Verify patch deployment across all systems, implement HTTP Content-Security-Policy headers to prevent inline script execution, and scan knowledge base records for residual malicious payloads.

GLPI CVE-2026-5385

Q: What is the CVSS score of CVE-2026-5385?

CVE-2026-5385 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34006 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-02 Fluid Attacks

XSS Glpi Glpi Project

8.4

CVSS 4.0 · Vendor: Fluid Attacks

Severity by source

Vendor (Fluid Attacks) PRIMARY

8.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Fluid Attacks) · only source for this CVE.

CVSS VectorVendor: Fluid Attacks

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 02, 2026 - 22:30 vuln.today

Analysis Generated

Jun 02, 2026 - 22:30 vuln.today

CVSS changed

Jun 02, 2026 - 20:22 NVD

8.4 (HIGH)

CVE Published

Jun 02, 2026 - 18:32 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item.

This issue affects glpi: before 11.0.7.

AnalysisAI

Stored cross-site scripting in GLPI before 11.0.7 allows an attacker with write access to the knowledge base to embed a persistent XSS payload that executes in the browsers of users who later view the affected knowledge base item. The flaw was reported by Fluid Attacks and is rated High severity (CVSS 8.4) by the vendor, who shipped a fix in the 11.0.7 security release; no public exploit identified at time of analysis and the issue is not on the CISA KEV list.

Technical ContextAI

GLPI is an open-source IT Service Management (ITSM) and asset management platform (cpe:2.3:a:glpi-project:glpi) widely used as an internal help-desk/CMDB. The knowledge base module accepts rich content from users granted write privileges and renders it back to other users when articles are viewed. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied markup was not sufficiently sanitized or output-encoded before being injected into the rendered DOM, allowing arbitrary script execution under the origin of the GLPI instance - including access to authenticated session cookies, CSRF tokens, and the ability to perform actions as the victim.

RemediationAI

Vendor-released patch: GLPI 11.0.7, available at https://github.com/glpi-project/glpi/releases/tag/11.0.7 - upgrading is the recommended and supported fix and also resolves several other High-severity issues bundled in the same release (CVE-2026-40108, CVE-2026-42318, CVE-2026-42317). If immediate upgrade is not feasible, restrict the 'knowledge base write' / KB editor profile to a small set of trusted administrators (this prevents the precondition but removes self-service KB authoring from technicians), monitor the glpi_knowbaseitems table for unexpected script/iframe/event-handler markup, and apply a strict Content Security Policy on the GLPI vhost that disallows inline script execution (note: GLPI's own UI uses some inline handlers, so test CSP in report-only mode before enforcing). Consult the GHSA-2fg5-jg72-h338 advisory for any vendor-supplied mitigation guidance.