Combodo iTop EUVD-2026-64148

Exploitation requires that the victim be authenticated to iTop with at least a low-privilege account at the time of attack (PR:L in the CVSS vector), and that the victim actively click or navigate to a crafted URL (UI:R). The vulnerable code path is the synchro_import.php endpoint, part of iTop's data synchronization module; no non-default configuration is required to expose this endpoint on a standard iTop installation prior to 3.2.3. The attacker does not need server-side access or administrative credentials. Exploitation is bounded by the requirement for social engineering to deliver the malicious link to an authenticated session - automated scanning cannot directly trigger the XSS without a victim's browser.

The CVSS 3.1 score of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects a network-reachable flaw of low attack complexity requiring a low-privileged authenticated victim to interact with a malicious link. The C:H/I:H/A:H ratings represent a worst-case session-hijacking outcome where a full administrator session is compromised. EPSS data was not provided in the input, so exploitation probability cannot be quantified from available signals. The CVE is absent from the CISA KEV catalog, and no public proof-of-concept has been disclosed, indicating the vulnerability has not been broadly weaponized. The mandatory UI:R constraint meaningfully limits opportunistic mass exploitation, requiring a social engineering step to deliver the crafted URL to an active user. Organizations running iTop for IT service management should nonetheless prioritize patching, because IT administrators are high-value XSS targets: session compromise at that level grants access to ITSM configuration, user account data, integrations, and potentially service catalog controls. The mismatch between high CVSS impact metrics and low exploitation evidence is consistent with a vulnerability that is severe in consequence but non-trivial to weaponize at scale.

An attacker with a low-privilege iTop account, or acting externally without an account, crafts a URL to synchro/synchro_import.php with a JavaScript payload embedded in the data_source_id query parameter and delivers it via phishing email or internal message to an IT administrator with an active iTop session. When the administrator clicks the link, the unsanitized parameter value is reflected into the HTML response and the injected script executes in the administrator's browser, potentially exfiltrating session cookies to an attacker-controlled server and enabling full account takeover. No public proof-of-concept has been identified, but the exploit primitive is a well-understood reflected XSS pattern requiring no specialized tooling.