GLPI heeft een Unauthenticated Stored XSS via inventaris

Successful exploitation of CVE-2026-26027 allows an attacker to execute arbitrary JavaScript code within the context of a victim's browser session. This can lead to various malicious outcomes, including session hijacking, credential theft, and defacement of the GLPI interface. An attacker could potentially gain access to sensitive asset information stored within GLPI, or use the compromised session to perform actions on behalf of an authenticated user. The impact is particularly severe given GLPI's role in managing IT assets and infrastructure, potentially granting attackers access to critical systems.

Organizations utilizing GLPI versions 11.0.0 through 11.0.5, particularly those with publicly accessible GLPI instances or those lacking robust input validation measures, are at significant risk. Shared hosting environments where multiple users share the same GLPI instance are also particularly vulnerable, as an attacker could potentially compromise the entire environment through a single successful XSS attack.

• php: Examine GLPI inventory endpoint logs for unusual characters or patterns indicative of XSS attempts. Look for POST requests containing <script> or <iframe> tags.

grep -i '<script' /var/log/apache2/access.log | grep glpi/inventory

• generic web: Use curl to test the inventory endpoint with a simple XSS payload and observe the response for script execution.

curl -X POST -d '<script>alert("XSS")</script>' http://your-glpi-server/inventory/

• generic web: Check GLPI's access and error logs for any unusual activity or error messages related to the inventory endpoint.

1. 2026-04-06Disclosure

   disclosure

1. Gereserveerd2026-02-09
2. Gepubliceerd2026-04-06
3. Gewijzigd2026-04-07
4. EPSS bijgewerkt2026-04-14

The primary mitigation for CVE-2026-26027 is to upgrade GLPI to version 11.0.6 or later, which contains the fix for this vulnerability. If upgrading immediately is not feasible, consider implementing input validation and sanitization on the inventory endpoint to prevent the injection of malicious scripts. While not a complete solution, this can reduce the attack surface. Review GLPI's web application firewall (WAF) configuration to ensure it can detect and block XSS attempts targeting the inventory endpoint. After upgrading, verify the fix by attempting to inject a simple XSS payload through the inventory endpoint; it should be properly sanitized and not execute.