CVE-2025-26626: GLPI Inventory Plugin XSS Vulnerability

CVE-2025-26626 Overview

CVE-2025-26626 is a reflected cross-site scripting (XSS) vulnerability in the GLPI Inventory Plugin, a component that handles inventory-related tasks for GLPI agents within the GLPI asset and IT management platform. Versions prior to 1.5.0 fail to properly sanitize user-controlled input, allowing attackers to inject and execute arbitrary JavaScript in the context of a victim's browser session. Successful exploitation requires user interaction, typically by convincing an authenticated GLPI user to click a crafted link. The maintainers addressed the flaw in version 1.5.0, released on 2025-02-25. The weakness is categorized under CWE-79.

Critical Impact
Attackers can execute arbitrary JavaScript in the browsers of GLPI users, enabling session theft, account takeover, and unauthorized actions against the asset management platform.

Affected Products

GLPI Inventory Plugin versions prior to 1.5.0
GLPI deployments using the Inventory Plugin for agent task handling
GLPI asset and IT management installations relying on vulnerable plugin builds

Discovery Timeline

2025-02-25 - GLPI Inventory Plugin 1.5.0 released with the fix
2025-03-14 - CVE-2025-26626 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26626

Vulnerability Analysis

The GLPI Inventory Plugin processes HTTP request parameters and reflects portions of that input back into rendered pages without adequate output encoding. When a victim loads a URL containing attacker-controlled payload data, the plugin renders the payload as part of the response, and the browser executes it as JavaScript. Because the script runs in the origin of the GLPI application, it inherits the session context of the authenticated user.

Attackers can leverage this to steal session cookies, perform actions on behalf of the victim, harvest CSRF tokens, or pivot toward administrative functions if a privileged user is targeted. Exploitation is network-reachable and requires no authentication from the attacker, but does require the victim to click a malicious link or visit an attacker-controlled page.

Root Cause

The root cause is missing or insufficient output encoding of user-supplied parameters when the plugin renders HTML responses. Input received via HTTP request parameters is embedded into the response body without contextual escaping, allowing HTML and JavaScript syntax to break out of the intended data context. This is a classic reflected XSS pattern classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation follows the standard reflected XSS pattern. An attacker crafts a URL that targets a vulnerable endpoint in the GLPI Inventory Plugin and embeds a JavaScript payload in a reflected parameter. The attacker delivers the URL via phishing email, chat, or a link on an external site. When an authenticated GLPI user opens the link, the injected script executes in their browser with access to the GLPI session.

The vulnerability has no verified public proof-of-concept exploit at the time of publication, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the GitHub Security Advisory GHSA-8p38-r7vf-j6jx for maintainer-provided details.

// No verified public exploit code is available.
// The vulnerability follows a reflected XSS pattern where
// attacker-controlled URL parameters are echoed into HTML
// output without contextual encoding.

Detection Methods for CVE-2025-26626

Indicators of Compromise

Web server access logs containing GLPI Inventory Plugin URLs with encoded <script>, javascript:, onerror=, or onload= payloads in query parameters.
Referer headers pointing to unexpected external domains preceding requests to plugin endpoints.
Unusual outbound requests from user browsers to attacker-controlled hosts immediately after visiting GLPI URLs.

Detection Strategies

Deploy web application firewall (WAF) rules that flag reflected XSS patterns in requests targeting GLPI Inventory Plugin paths.
Correlate authenticated GLPI session activity with suspicious parameter values containing HTML or JavaScript syntax.
Inspect browser telemetry and endpoint EDR data for script execution originating from the GLPI origin followed by anomalous network activity.

Monitoring Recommendations

Monitor GLPI application logs and reverse proxy logs for repeated requests to Inventory Plugin endpoints with encoded angle brackets or event handler attributes.
Track user reports of unexpected redirects or authentication prompts when navigating within GLPI.
Alert on new outbound connections from workstations to low-reputation domains shortly after GLPI usage.

How to Mitigate CVE-2025-26626

Immediate Actions Required

Upgrade the GLPI Inventory Plugin to version 1.5.0 or later on all GLPI servers.
Audit GLPI user accounts for unexpected activity and force reauthentication for privileged users following the upgrade.
Review web server and application logs for prior requests matching reflected XSS patterns against plugin endpoints.

Patch Information

The GLPI Inventory Plugin maintainers released version 1.5.0 on 2025-02-25, which remediates the reflected XSS flaw. Administrators should follow the upgrade instructions in the GLPI Inventory Plugin Changelog and consult the GitHub Security Advisory GHSA-8p38-r7vf-j6jx for advisory metadata.

Workarounds

Restrict access to the GLPI web interface to trusted networks or VPN users until the plugin can be upgraded.
Deploy a WAF policy that blocks requests containing HTML or JavaScript syntax in query parameters targeting Inventory Plugin routes.
Enforce a strict Content Security Policy (CSP) on the GLPI application to reduce the impact of inline script execution.

bash

# Example: upgrade the GLPI Inventory Plugin to the fixed release
cd /var/www/glpi/plugins
rm -rf glpiinventory
wget https://github.com/glpi-project/glpi-inventory-plugin/releases/download/1.5.0/glpiinventory-1.5.0.tar.bz2
tar -xjf glpiinventory-1.5.0.tar.bz2
chown -R www-data:www-data glpiinventory
# Then activate the updated plugin from the GLPI administration interface