CVE-2026-26027: 
GLPI vulnerability analysis and mitigation

CVE-2026-26027 is an unauthenticated stored Cross-Site Scripting (XSS) vulnerability in GLPI, a free asset and IT management software package. It affects GLPI versions 11.0.0 through 11.0.5, allowing an unauthenticated attacker to inject and persist malicious XSS payloads via the inventory endpoint. The vulnerability was published on April 6, 2026, and fixed in version 11.0.6. It carries a CVSS v3.1 base score of 6.1 (Medium) per NVD, and 7.5 (High) per the GitHub Security Advisory (GitHub Advisory).

The vulnerability is rooted in three weaknesses: CWE-79 (Improper Neutralization of Input During Web Page Generation), CWE-116 (Improper Encoding or Escaping of Output), and CWE-306 (Missing Authentication for Critical Function). The inventory endpoint in GLPI fails to require authentication and does not properly sanitize or encode user-supplied input before storing and rendering it, enabling stored XSS. An unauthenticated remote attacker can submit a crafted inventory request containing a malicious script payload, which is then persisted server-side and executed in the browsers of authenticated users who subsequently view the affected content. The vulnerability was reported by BZHunt (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to store malicious JavaScript that executes in the browser context of any authenticated user who views the compromised inventory data. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims, malware distribution, and application defacement. Because GLPI is used for IT asset management, compromise of administrator sessions could expose sensitive infrastructure data and enable further lateral movement within an organization (GitHub Advisory).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.046%, indicating a low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the unauthenticated nature of the attack vector lowers the barrier for exploitation significantly.

1. Reconnaissance: Identify internet-facing GLPI instances running versions 11.0.0–11.0.5 using tools like Shodan or Censys, searching for GLPI login pages or version banners.
2. Locate the inventory endpoint: Identify the unauthenticated inventory submission endpoint (e.g., /front/inventory.php or equivalent GLPI inventory API endpoint) that accepts asset data without requiring authentication.
3. Craft malicious payload: Prepare an inventory submission (e.g., XML or JSON format used by GLPI's inventory agent) that includes a stored XSS payload within a field that is later rendered in the GLPI web interface (e.g., asset name, description, or hardware field).
4. Submit the payload: Send the crafted inventory request to the endpoint without any authentication credentials, causing the malicious script to be stored in the GLPI database.
5. Wait for victim interaction: When an authenticated GLPI user (e.g., an IT administrator) browses the inventory section and views the compromised asset entry, the stored XSS payload executes in their browser.
6. Achieve objective: The executed script can steal session cookies, redirect the user, exfiltrate sensitive data, or perform actions within GLPI on behalf of the victim (GitHub Advisory).

• Network: Unexpected or anomalous POST requests to the GLPI inventory endpoint (e.g., /front/inventory.php) from unauthenticated or unknown source IPs; requests containing HTML/JavaScript tags (<script>, onerror=, javascript:) in inventory data fields.
• Logs: GLPI web server access logs showing unauthenticated submissions to the inventory endpoint with unusually large or malformed payloads; repeated inventory submissions from the same IP without corresponding agent registration.
• File System / Database: Stored inventory records in the GLPI database containing JavaScript or HTML tags in asset name, description, or hardware fields that are not consistent with legitimate inventory data.
• Browser/User Reports: Authenticated users reporting unexpected pop-ups, redirects, or unusual behavior when browsing the GLPI inventory section, which may indicate XSS payload execution.

The primary remediation is to upgrade GLPI to version 11.0.6 or later, which contains the fix for this vulnerability (GitHub Advisory). If immediate patching is not feasible, restrict access to the inventory endpoint at the network perimeter or WAF level to trusted IP ranges (e.g., known inventory agent hosts only). Additionally, implement Content Security Policy (CSP) headers to reduce the impact of any XSS execution, and review existing inventory records for injected payloads. Organizations should also monitor inventory endpoint logs for suspicious unauthenticated submissions.

The vulnerability was credited to BZHunt, who reported it to the GLPI security team (GitHub Advisory). The advisory was published by the GLPI project on April 3–6, 2026, and has been tracked by standard vulnerability aggregators including VulDB and Tenable (Nessus plugin 305612). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability tracking.