CVE-2026-26027: GLPI Asset Management XSS Vulnerability

CVE-2026-26027 Overview

CVE-2026-26027 is a stored Cross-Site Scripting (XSS) vulnerability affecting GLPI, a popular free and open-source IT asset and service management software package. The vulnerability allows unauthenticated attackers to inject malicious JavaScript payloads through the inventory endpoint. These payloads are then stored and executed when other users, including administrators, view the affected data within the GLPI interface.

Critical Impact

Unauthenticated attackers can inject persistent XSS payloads that execute in the context of authenticated users, potentially leading to session hijacking, credential theft, or administrative account compromise.

Affected Products

• GLPI versions 11.0.0 through 11.0.5
• glpi-project glpi (all installations within the vulnerable version range)

Discovery Timeline

• April 6, 2026 - CVE-2026-26027 published to NVD
• April 7, 2026 - Last updated in NVD database

Technical Details for CVE-2026-26027

Vulnerability Analysis

This stored XSS vulnerability exists in GLPI's inventory endpoint, which accepts and processes asset data without proper sanitization of user-supplied input. The flaw is particularly severe because it does not require authentication, meaning any external attacker with network access to the GLPI instance can inject malicious scripts.

When a legitimate user (such as an IT administrator) accesses the GLPI dashboard or views inventory data, the stored malicious payload executes in their browser session. This can lead to session token theft, unauthorized actions performed on behalf of the victim, or further exploitation of the GLPI system. The vulnerability has a changed scope impact, meaning the XSS payload execution can affect security contexts beyond the vulnerable component itself.

Root Cause

The root cause of CVE-2026-26027 is improper input validation and output encoding in the GLPI inventory endpoint (CWE-79). The application fails to properly sanitize user-controlled data before storing it in the database and subsequently fails to encode this data when rendering it in HTML responses. This allows attackers to inject script tags or event handlers that persist in the system and execute when rendered in a user's browser.

Attack Vector

The attack is conducted over the network and requires user interaction for successful exploitation. An attacker sends a crafted HTTP request to the inventory endpoint containing an XSS payload embedded within inventory data fields. Since no authentication is required to access this endpoint, the attack can be performed by any external actor. Once stored, the payload awaits execution when an authenticated user views the compromised inventory record.

The vulnerability mechanism involves the inventory endpoint accepting untrusted data that is stored without sanitization. When this data is later rendered in the web interface, the malicious script executes in the victim's browser context, potentially allowing the attacker to steal session cookies, redirect users to malicious sites, or perform actions on behalf of the authenticated user. For complete technical details, refer to the GLPI Security Advisory.

Detection Methods for CVE-2026-26027

Indicators of Compromise

• Unusual or malformed entries in GLPI inventory records containing script tags, event handlers (e.g., onerror, onload), or JavaScript URIs
• HTTP access logs showing suspicious POST requests to the inventory endpoint from external or unexpected IP addresses
• Browser console errors or unexpected script execution when viewing GLPI inventory pages
• User reports of unusual behavior or redirects when accessing GLPI

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common XSS payloads in requests to GLPI endpoints
• Enable detailed logging on the GLPI application and web server to capture all requests to the inventory endpoint
• Deploy Content Security Policy (CSP) headers to detect and report inline script execution attempts
• Monitor GLPI database tables storing inventory data for entries containing suspicious HTML or JavaScript patterns

Monitoring Recommendations

• Configure real-time alerting for requests to the inventory endpoint containing potentially malicious characters or patterns
• Regularly audit stored inventory data for signs of XSS payload injection
• Monitor user session activity for anomalies that could indicate session hijacking following XSS exploitation
• Review access logs for repeated or automated requests to inventory submission endpoints

How to Mitigate CVE-2026-26027

Immediate Actions Required

• Upgrade GLPI to version 11.0.6 or later immediately, as this version contains the official fix for CVE-2026-26027
• If immediate upgrade is not possible, consider restricting network access to the GLPI inventory endpoint using firewall rules
• Review existing inventory records for signs of malicious payload injection and sanitize affected data
• Enable Web Application Firewall protection to filter XSS payloads targeting GLPI

Patch Information

The GLPI development team has addressed this vulnerability in version 11.0.6. The fix implements proper input validation and output encoding for data processed through the inventory endpoint. Organizations should update to this patched version as soon as possible.

For detailed patch information and upgrade instructions, refer to the GLPI Security Advisory.

Workarounds

• Restrict access to the GLPI inventory endpoint at the network level using firewall rules or reverse proxy configurations to allow only trusted IP addresses
• Implement Content Security Policy (CSP) headers to mitigate the impact of XSS by preventing inline script execution
• Deploy a Web Application Firewall (WAF) with rules configured to detect and block XSS payloads
• Consider temporarily disabling the inventory endpoint if it is not critical for operations until the patch can be applied

# Example: Restrict access to inventory endpoint using Apache configuration
<Location "/front/inventory.php">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>