EUVD-2026-34006Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item.
This issue affects glpi: before 11.0.7.
AnalysisAI
Stored cross-site scripting in GLPI before 11.0.7 allows an attacker with write access to the knowledge base to embed a persistent XSS payload that executes in the browsers of users who later view the affected knowledge base item. The flaw was reported by Fluid Attacks and is rated High severity (CVSS 8.4) by the vendor, who shipped a fix in the 11.0.7 security release; no public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must hold a GLPI account with write permission to the knowledge base module (CVSS PR:H - note the description's 'unauthenticated' wording conflicts with this and appears to be an error), and a victim user must actively browse to the poisoned KB article (UI:A). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H scores 8.4 (High) but reflects an interesting profile: network-reachable and low-complexity, yet requiring high privileges (a user with knowledge-base write permission) and active user interaction (a victim viewing the malicious article). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A help-desk technician or KB editor whose account has been phished, or a malicious insider with KB write rights, creates or edits a knowledge base article containing a JavaScript payload disguised in formatted content. When an administrator or another technician opens the article from the GLPI portal, the script runs in their authenticated session and exfiltrates their session cookie or silently issues privileged API calls (e.g., creating a new super-admin user) on their behalf. |
| Remediation | Vendor-released patch: GLPI 11.0.7, available at https://github.com/glpi-project/glpi/releases/tag/11.0.7 - upgrading is the recommended and supported fix and also resolves several other High-severity issues bundled in the same release (CVE-2026-40108, CVE-2026-42318, CVE-2026-42317). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all GLPI instances and document their versions; restrict knowledge base editor access if patch deployment cannot complete within 48 hours. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today