CVE-2026-25590: GLPI Inventory Plugin XSS Vulnerability

CVE-2026-25590 Overview

CVE-2026-25590 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the GLPI Inventory Plugin, which handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to version 1.6.6, the task jobs functionality contains a reflected XSS vulnerability that allows attackers to inject malicious scripts through specially crafted requests.

Critical Impact

Attackers can execute arbitrary JavaScript code in the context of authenticated user sessions, potentially leading to session hijacking, data theft, or unauthorized actions within the GLPI management interface.

Affected Products

• GLPI Inventory Plugin versions prior to 1.6.6
• glpi-project glpi_inventory (cpe:2.3:a:glpi-project:glpi_inventory:*:*:*:*:*:*:*:*)

Discovery Timeline

• 2026-03-03 - CVE-2026-25590 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-25590

Vulnerability Analysis

This reflected XSS vulnerability exists in the task jobs functionality of the GLPI Inventory Plugin. The vulnerability occurs when user-supplied input is improperly sanitized before being reflected back to the browser in HTTP responses. This allows attackers to craft malicious URLs containing JavaScript payloads that execute when a victim user clicks on the link while authenticated to the GLPI interface.

The network-accessible attack vector means no local access is required, and the scope change indicates that the vulnerability can impact resources beyond the vulnerable component. While user interaction is required (clicking a malicious link), no privileges are needed to craft and distribute the attack payload.

Root Cause

The root cause of this vulnerability is improper input validation and output encoding in the task jobs module (CWE-79). The application fails to properly sanitize user-controlled input before including it in dynamically generated web pages, allowing script injection through reflected parameters.

Attack Vector

The attack leverages the network-accessible task jobs interface where user input is reflected without proper encoding. An attacker would typically:

1. Craft a malicious URL containing a JavaScript payload targeting the vulnerable task jobs parameter
2. Distribute the URL through phishing emails, social engineering, or other means
3. When an authenticated GLPI user clicks the link, the malicious script executes in their browser context
4. The script can then steal session cookies, perform actions on behalf of the user, or redirect to malicious sites

The vulnerability manifests in the task jobs request handling where user-supplied data is reflected directly into the HTML response. For technical details and specific affected endpoints, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-25590

Indicators of Compromise

• Unusual URL parameters in web server access logs containing encoded JavaScript or HTML tags targeting task jobs endpoints
• Anomalous HTTP requests with suspicious query strings directed at the GLPI Inventory Plugin
• User reports of unexpected behavior or redirects when accessing GLPI management interface
• Session activity from unexpected IP addresses following legitimate user sessions

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block XSS payloads in request parameters
• Monitor access logs for requests containing common XSS patterns such as <script>, javascript:, or encoded variants
• Deploy browser-based security controls and Content Security Policy (CSP) headers to mitigate script execution
• Use SentinelOne Singularity platform to monitor for suspicious browser activity and script injection attempts on endpoints accessing GLPI

Monitoring Recommendations

• Enable detailed logging for all GLPI Inventory Plugin endpoints, particularly task jobs functionality
• Configure SIEM alerts for URL patterns matching XSS injection attempts against GLPI infrastructure
• Implement real-time monitoring of user session activities for anomalous behavior patterns
• Review authentication logs for session anomalies following detected XSS attempts

How to Mitigate CVE-2026-25590

Immediate Actions Required

• Upgrade GLPI Inventory Plugin to version 1.6.6 or later immediately
• Review web server access logs for evidence of exploitation attempts
• Implement Content Security Policy (CSP) headers to restrict script execution sources
• Consider temporarily restricting access to task jobs functionality until patching is complete
• Educate users about phishing risks and suspicious links

Patch Information

The vulnerability has been addressed in GLPI Inventory Plugin version 1.6.6. Organizations should upgrade to this version or later to remediate the vulnerability. The fix implements proper input validation and output encoding for user-supplied data in the task jobs module.

For detailed patch information and upgrade instructions, refer to the GLPI Inventory Plugin Security Advisory.

Workarounds

• Implement strict Content Security Policy (CSP) headers that disable inline script execution
• Deploy a Web Application Firewall (WAF) with XSS filtering rules in front of the GLPI instance
• Restrict network access to the GLPI interface to trusted IP ranges using firewall rules
• Enable HTTPOnly and Secure flags on session cookies to limit cookie theft impact

# Example Apache CSP header configuration to mitigate XSS
# Add to Apache virtual host or .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self';"
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"