GLPI EUVD-2026-87283

Requires an authenticated account with technician-level privileges (PR:H) able to edit supplier records, specifically to inject markup into the supplier 'website' field. Exploitation is stored/persistent but only triggers when a second user opens the affected item's suppliers list within the contact-supplier or contract-supplier views (UI:P). Limiting factors: attacker must already hold a privileged internal account or compromise one; a victim must actively navigate to the suppliers list; and only GLPI versions 11.0.6 through pre-11.0.8 are affected (patched in 11.0.8). This is effectively an insider/privileged-account XSS vector rather than remote-unauthenticated.

This is a stored XSS (CWE-116, improper output encoding) in GLPI's supplier website fields, confirmed by the vendor security advisory GHSA-8v8p-w8mq-wqcg and the fixing commit 970786ed. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H, score 8.5) shows two important limiting factors: PR:H means the payload can only be planted by an authenticated technician-level account, and UI:P means a victim must actively open the affected item's suppliers list. The vendor's rating of VC:H/VI:H/VA:H (full high impact on all three) appears overstated for a stored XSS confined to a rendered web page - realistic impact is session/action hijacking within another user's browser context, not direct full compromise of confidentiality/integrity/availability. No EPSS score, no CISA KEV listing, and no public exploit code are provided, so there is no signal of active exploitation or automation. No SSVC decision data was supplied. Net: this is a legitimate flaw to patch but is not a high-urgency, mass-exploitable issue - it requires an already-privileged insider (or a compromised technician account) to plant the payload and a second user to view it, making it more of a targeted/insider risk than a widespread threat.

An authenticated GLPI technician (or an attacker who has phished/compromised such an account) edits a supplier record and stores a JavaScript payload in the website field. When another user - potentially a higher-privileged administrator - later opens that item's suppliers list (via the contact or contract supplier view), the script executes in their browser session, enabling session/action hijacking in GLPI. No public proof-of-concept exploit is identified at time of analysis.