CVE-2026-25590: GLPI Inventory Plugin XSS Vulnerability

CVE-2026-25590 Overview

CVE-2026-25590 is a reflected Cross-Site Scripting (XSS) vulnerability in the GLPI Inventory Plugin, which handles network discovery, inventory, software deployment, and data collection for GLPI agents. The flaw exists in the task jobs functionality of versions prior to 1.6.6. An attacker can craft a malicious URL that, when visited by an authenticated GLPI user, executes arbitrary JavaScript in the victim's browser session. The issue is tracked as CWE-79: Improper Neutralization of Input During Web Page Generation and is fixed in version 1.6.6.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in an authenticated administrator's browser, enabling session theft, unauthorized inventory operations, and pivoting into managed assets.

Affected Products

GLPI Inventory Plugin versions prior to 1.6.6
GLPI deployments using the inventory plugin for agent management
Environments using the plugin for network discovery and software deployment

Discovery Timeline

2026-03-03 - CVE-2026-25590 published to NVD
2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-25590

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the task jobs feature of the GLPI Inventory Plugin. User-supplied input is echoed back into the rendered HTML response without proper output encoding or sanitization. An attacker constructs a URL containing JavaScript payload parameters and delivers it to an authenticated GLPI user through phishing or social engineering. When the victim loads the URL, the payload executes within the trusted GLPI origin.

Because GLPI is an IT asset management platform typically used by administrators, the executing script inherits high-privilege session context. Attackers can perform actions on behalf of the victim, including modifying inventory records, triggering software deployments, or exfiltrating session tokens. The CVSS vector indicates a scope change, meaning the impact extends beyond the vulnerable component to other resources in the browser context.

Root Cause

The root cause is improper neutralization of user-controllable input within the task jobs HTML response generation logic. The plugin reflects request parameters back to the page without HTML-encoding metacharacters such as <, >, and ". This allows arbitrary HTML and <script> content to be injected into the DOM.

Attack Vector

Exploitation requires user interaction. The attacker delivers a crafted link, and the victim must click it while authenticated to GLPI. No prior privileges are required from the attacker. The attack is delivered over the network and executes in the victim's browser, making it well-suited for targeted phishing campaigns against IT administrators.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. For technical details, see the GitHub Security Advisory GHSA-54x7-6fhx-3wmw.

Detection Methods for CVE-2026-25590

Indicators of Compromise

HTTP request logs containing script tags, javascript: URIs, or HTML event handlers in query parameters targeting GLPI task jobs endpoints
Unusual outbound requests from administrator browsers to attacker-controlled domains following GLPI sessions
Anomalous changes to inventory records, task jobs, or deployment configurations not associated with legitimate admin activity

Detection Strategies

Inspect web server and reverse proxy access logs for encoded payloads such as %3Cscript%3E, onerror=, or onload= in URLs targeting the plugin
Deploy a Web Application Firewall (WAF) rule set that flags reflected XSS patterns on GLPI plugin endpoints
Correlate referrer headers and email gateway logs to identify users who clicked external links leading to GLPI URLs containing suspicious parameters

Monitoring Recommendations

Enable verbose HTTP request logging on the GLPI front-end web server and forward logs to a centralized SIEM for analysis
Monitor GLPI audit trails for unexpected modifications to task jobs, software packages, or agent assignments
Track browser-side Content Security Policy (CSP) violation reports if CSP is enforced on the GLPI domain

How to Mitigate CVE-2026-25590

Immediate Actions Required

Upgrade the GLPI Inventory Plugin to version 1.6.6 or later on all GLPI instances
Audit recent administrator activity in GLPI for unauthorized changes to task jobs or inventory data
Instruct administrators to avoid clicking GLPI links from untrusted sources until patching is complete

Patch Information

The maintainers fixed the vulnerability in GLPI Inventory Plugin version 1.6.6. Download the patched release from the GLPI Inventory Plugin project on GitHub and follow the standard plugin upgrade procedure within the GLPI administration interface. Restart relevant services after the upgrade and validate plugin functionality.

Workarounds

Restrict access to the GLPI web interface using IP allow-listing or VPN-only access to reduce exposure to external phishing payloads
Deploy a strict Content Security Policy on the GLPI domain to limit inline script execution and block unauthorized script sources
Configure WAF rules to inspect and block request parameters containing HTML or JavaScript metacharacters on inventory plugin endpoints

bash

# Example WAF rule (ModSecurity) blocking reflected XSS patterns on plugin endpoints
SecRule REQUEST_URI "@contains /plugins/glpiinventory/" \
    "chain,deny,status:403,id:1025590,msg:'Potential reflected XSS against GLPI Inventory Plugin (CVE-2026-25590)'"
    SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:none,t:urlDecodeUni"