Combodo iTop EUVD-2026-64084

Exploitation requires two prerequisites: (1) the attacker must socially engineer an already-authenticated iTop user (PR:L per CVSS vector) into clicking a crafted URL - unauthenticated users cannot trigger the vulnerability because the tagadmin.php page requires login; (2) the victim must actively interact with the malicious link (UI:R per CVSS vector). The tag administration feature (pages/tagadmin.php) must be accessible to the victim's account role. What limits exploitation: the attacker cannot force interaction; the victim's session is required; and the attack surface is confined to a specific administrative page rather than the entire application. Default iTop deployments with administrator-only access to tagadmin.php reduce the viable victim pool, though any role granted tag administration access is a potential target.

The vendor-assigned CVSS 3.1 score of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) requires both an authenticated user (PR:L) and victim interaction (UI:R), which meaningfully constrains exploitation compared to unauthenticated or zero-click vulnerabilities. The high C/I/A impact ratings reflect the potential to fully compromise an authenticated session - an attacker who hijacks an iTop admin session gains full control over the ITSM configuration and data. However, the A:H rating is aggressive for reflected XSS, which does not typically cause direct availability disruption; this appears to account for worst-case admin-session abuse. No EPSS data was provided, no CISA KEV listing exists, and no public exploit code has been identified, suggesting this is a moderate real-world priority despite the numerical score. The primary realistic risk is targeted phishing of iTop administrators via crafted links, not opportunistic mass scanning.

An attacker targeting an iTop administrator constructs a URL pointing to pages/tagadmin.php with a crafted $sFilter parameter containing a JavaScript payload (e.g., a cookie-stealing script) and sends it via phishing email or embedded link. When the administrator clicks the link while authenticated to iTop, the unsanitized parameter is reflected into the page HTML and the script executes in their browser, transmitting their session token to an attacker-controlled endpoint. No public proof-of-concept code has been identified, but the vulnerability pattern is straightforward to exploit given knowledge of the affected parameter.