GLPI CVE-2026-5385

Attacker must hold a GLPI account with write permission to the knowledge base module (CVSS PR:H - note the description's 'unauthenticated' wording conflicts with this and appears to be an error), and a victim user must actively browse to the poisoned KB article (UI:A). Exploitation is limited to GLPI instances running any version prior to 11.0.7; no special non-default configuration is required beyond the KB module being in use, and the attack works over the normal web interface (AV:N) without elevated network position.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H scores 8.4 (High) but reflects an interesting profile: network-reachable and low-complexity, yet requiring high privileges (a user with knowledge-base write permission) and active user interaction (a victim viewing the malicious article). The textual description's phrase 'unauthenticated user with write access' directly contradicts the PR:H attribute in the CVSS vector - write access to the KB in GLPI is a privileged role, so PR:H appears correct and the description wording should be treated as imprecise; defenders should not assume truly unauthenticated exploitation. There is no EPSS, KEV, or public POC signal in the provided data, so this is best treated as a high-impact-but-conditional issue: realistic risk depends heavily on how broadly KB write access is delegated inside the organization and how trusted those authors are.

A help-desk technician or KB editor whose account has been phished, or a malicious insider with KB write rights, creates or edits a knowledge base article containing a JavaScript payload disguised in formatted content. When an administrator or another technician opens the article from the GLPI portal, the script runs in their authenticated session and exfiltrates their session cookie or silently issues privileged API calls (e.g., creating a new super-admin user) on their behalf.