CVE-2025-27514: Glpi-project GLPI Stored XSS Vulnerability

CVE-2025-27514 Overview

CVE-2025-27514 is a stored Cross-Site Scripting (XSS) vulnerability in GLPI, an open-source IT asset and service management platform. The flaw affects GLPI versions 9.5.0 through 10.0.18 and is fixed in version 10.0.19. An authenticated user with technician-level privileges can inject a malicious payload that executes when other users view the project's kanban board. The issue is tracked under CWE-79 and disclosed in GitHub Security Advisory GHSA-jh8j-gqxc-6gqj.

Critical Impact
A malicious technician can execute arbitrary JavaScript in the browsers of users viewing the project kanban, enabling session theft, action forgery, and lateral movement within the GLPI application.

Affected Products

GLPI 9.5.0 through 10.0.18
glpi-project/glpi (self-hosted deployments)
IT service desk and asset management instances exposing the project kanban feature

Discovery Timeline

2025-07-29 - CVE CVE-2025-27514 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27514

Vulnerability Analysis

The vulnerability is a stored XSS defect in GLPI's project kanban rendering path. A user holding technician permissions can supply crafted input that is persisted to the database and later reflected into the kanban view without adequate output encoding. When any authenticated user opens the affected project's kanban, the payload executes in the browser under the GLPI origin.

Because execution occurs in-session, the payload inherits the victim's privileges. This enables attackers to perform authenticated actions such as creating tickets, altering assets, or exfiltrating session data. Administrators viewing the kanban present the highest-value target for privilege escalation within the application.

Root Cause

The root cause is missing or insufficient contextual output escaping in the code path that renders kanban card content. Related regex handling in ticket image processing also failed to escape user-controlled data used as a pattern, allowing metacharacters in filenames or tags to influence matching. The upstream commit hardens this by wrapping user-controlled data with preg_quote() before use in regex patterns.

Attack Vector

Exploitation requires an authenticated technician account and user interaction from a victim who loads the project kanban. Once the payload is stored, no further action is required from the attacker. The scope is changed because script execution in a victim's browser can reach resources beyond the attacker's own account.

php

             foreach ($matches[0] as $src_attr) {
                 // Set tag if image matches
                 foreach ($files as $data => $filename) {
-                    if (preg_match("/" . $data . "/i", $src_attr)) {
+                    if (preg_match("/" . preg_quote($data, '/') . "/i", $src_attr)) {
                         $html = preg_replace("/<img[^>]*" . preg_quote($src_attr, '/') . "[^>]*>/s", "<p>" . Document::getImageTag($tags[$filename]) . "</p>", $html);
                     }
                 }
// Source: https://github.com/glpi-project/glpi/commit/c340a64a11343bde706d1cd41e4be798dd922303

The patch escapes $data with preg_quote() before embedding it in a regular expression, preventing metacharacter injection during image tag processing in src/Ticket.php.

Detection Methods for CVE-2025-27514

Indicators of Compromise

Kanban card titles, descriptions, or comments containing HTML tags such as <script>, <img onerror=>, or <svg onload=>.
Unexpected outbound HTTP requests from user browsers to attacker-controlled domains shortly after loading /front/project.form.php or kanban views.
Session cookie use from unexpected geolocations following technician updates to project items.

Detection Strategies

Review GLPI database tables backing project tasks and kanban items for HTML event handlers or javascript: URIs in user-supplied fields.
Enable and inspect web server access logs for POST requests to project and kanban endpoints containing encoded script payloads.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script violations originating from GLPI pages.

Monitoring Recommendations

Alert on browser-side CSP violation reports referencing GLPI origins.
Monitor for anomalous administrative actions performed immediately after a technician's project edits.
Track GLPI version strings in HTTP responses to identify unpatched instances across the estate.

How to Mitigate CVE-2025-27514

Immediate Actions Required

Upgrade GLPI to version 10.0.19 or later on all instances.
Audit technician accounts and revoke credentials that are unused or over-privileged.
Force session invalidation for users who may have viewed compromised project kanbans since exposure.

Patch Information

The fix is delivered in GLPI 10.0.19. Refer to the upstream GitHub commit c340a64 and the GHSA-jh8j-gqxc-6gqj advisory for patch details and remediation guidance.

Workarounds

Restrict access to the project kanban feature to trusted operators until the patch is applied.
Deploy a strict Content Security Policy that disallows inline scripts on GLPI pages.
Place GLPI behind a web application firewall with rules blocking common XSS payload patterns on project endpoints.

bash

# Example: verify installed GLPI version and upgrade via composer/tarball workflow
grep -R "define('GLPI_VERSION'" /var/www/glpi/inc/define.php
# Then apply the 10.0.19 release from https://github.com/glpi-project/glpi/releases