CVE-2025-52897: GLPI Planning Feature XSS Vulnerability

CVE-2025-52897 Overview

CVE-2025-52897 is a reflected cross-site scripting (XSS) vulnerability in GLPI, an open-source IT asset and service management platform. The flaw exists in the planning feature and affects versions 9.1.0 through 10.0.18. An unauthenticated attacker can craft a malicious link that, when clicked by a victim, executes attacker-controlled content in the browser context and facilitates phishing attacks. The GLPI project addressed the issue in version 10.0.19. The vulnerability is tracked under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page.

Critical Impact
An unauthenticated attacker can weaponize a GLPI planning URL to deliver phishing content to authenticated users, potentially leading to credential theft or session compromise.

Affected Products

GLPI versions 9.1.0 through 10.0.18
GLPI planning feature component
Fixed in GLPI 10.0.19

Discovery Timeline

2025-07-30 - CVE-2025-52897 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52897

Vulnerability Analysis

The vulnerability resides in the GLPI planning feature, which manages calendar and scheduling data for IT service management workflows. GLPI fails to properly neutralize script-related HTML tags in user-supplied input reflected through the planning interface. This classification aligns with [CWE-80], covering improper sanitization of script tags such as <script> in rendered HTML output.

Because the endpoint is reachable without authentication, an attacker does not need valid GLPI credentials to craft the malicious payload. Delivery relies on user interaction, typically a victim clicking a specially crafted link. The scope change reflected in the CVSS vector indicates the injected content can affect resources beyond the initially vulnerable component, such as the authenticated user's session or trust boundary.

Root Cause

The root cause is missing or insufficient output encoding of parameters processed by the planning feature. Input arriving through URL parameters is reflected into the response without escaping HTML metacharacters, allowing browser-side execution of attacker-supplied markup.

Attack Vector

The attack is network-based and requires no privileges. An attacker constructs a URL targeting the GLPI planning endpoint with an embedded payload and distributes the link through email, chat, or web content. When a GLPI user opens the link, the payload renders inside the trusted GLPI origin. Attackers commonly abuse this to display fake login prompts, harvest credentials, or redirect to attacker-controlled infrastructure. Full technical details are available in the GitHub Security Advisory GHSA-6whm-q2rp-prqm.

Detection Methods for CVE-2025-52897

Indicators of Compromise

Inbound requests to GLPI planning endpoints containing HTML or JavaScript metacharacters such as <script>, onerror=, or javascript: in query strings
Referrer headers pointing to unfamiliar external domains preceding access to GLPI planning URLs
Unexpected outbound requests from user browsers to third-party domains immediately after visiting GLPI planning pages

Detection Strategies

Deploy web application firewall (WAF) rules that inspect and block reflected XSS patterns in requests to /front/planning.php and related planning routes
Review GLPI HTTP access logs for query parameters containing encoded script payloads or unusual character sequences
Correlate authentication anomalies, such as session reuse from new IPs, with recent user visits to crafted planning URLs

Monitoring Recommendations

Monitor GLPI application logs for repeated requests to planning endpoints from a single source with variable payloads
Alert on outbound DNS or HTTP requests from user endpoints to newly registered domains following GLPI activity
Track user-reported phishing lures that reference GLPI or internal ticketing URLs

How to Mitigate CVE-2025-52897

Immediate Actions Required

Upgrade GLPI to version 10.0.19 or later, which contains the official fix
Inventory all GLPI instances, including internet-exposed installations, and confirm versions against the affected range 9.1.0 through 10.0.18
Notify GLPI users about the phishing risk and instruct them to avoid clicking unsolicited GLPI links until patching completes

Patch Information

The GLPI project released version 10.0.19 with the sanitization fix for the planning feature. Details and remediation guidance are published in the GLPI GitHub Security Advisory GHSA-6whm-q2rp-prqm. Administrators should follow the standard GLPI upgrade procedure and validate database migrations after applying the update.

Workarounds

Restrict access to the GLPI planning feature at the reverse proxy or WAF layer until patching is complete
Enforce a strict Content Security Policy (CSP) header on the GLPI application to limit inline script execution
Require authentication in front of the GLPI application via a reverse proxy to reduce unauthenticated exposure

bash

# Example nginx configuration adding a restrictive CSP header for GLPI
server {
    listen 443 ssl;
    server_name glpi.example.com;

    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self';" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    location / {
        proxy_pass http://127.0.0.1:8080;
    }
}