CVE-2026-30826: Combodo iTop XSS Vulnerability

CVE-2026-30826 Overview

Combodo iTop is a web-based IT service management (ITSM) tool used to manage IT infrastructure, incidents, and change requests. CVE-2026-30826 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the OQL (Object Query Language) query testing functionality. The flaw exists in the pages/run_query.php component, where the query expression parameter used in suggested OQL syntax error responses is rendered without proper HTML escaping. An authenticated attacker can craft a malicious OQL expression that, when reflected in the syntax error suggestion, executes arbitrary JavaScript in the victim's browser. The issue affects all iTop versions prior to 3.2.3.

Critical Impact
Successful exploitation enables session hijacking, credential theft, and administrative actions performed in the context of the authenticated iTop user.

Affected Products

Combodo iTop versions prior to 3.2.3
iTop run_query.php OQL testing page
Deployments exposing the query testing interface to authenticated users

Discovery Timeline

2026-08-21 - CVE CVE-2026-30826 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-30826

Vulnerability Analysis

The vulnerability resides in the OQL query testing page, which allows users to submit query expressions and receive parser feedback. When the OQL parser encounters a syntax error and generates a corrective suggestion, the response builds an HTML string containing portions of the user-supplied expression. The trailing portion of the expression ($sAfter) was concatenated directly into the HTML output without sanitization. An attacker who convinces an authenticated iTop user to submit or visit a crafted URL can execute arbitrary JavaScript within the application origin. Because iTop is an ITSM platform typically operated by privileged administrators, exploitation can lead to takeover of infrastructure management workflows.

Root Cause

The defect stems from missing output encoding in the syntax error suggestion renderer. The $sBefore, suggested-word, and $sAfter fragments were concatenated into an HTML string, but only the highlighted suggestion was wrapped in a <span> element. The remaining user-controlled fragments bypassed the utils::EscapeHtml() sanitizer, allowing raw HTML and script tags in the reflected response.

Attack Vector

Exploitation requires an authenticated session and user interaction, such as clicking a prepared link that submits a malicious OQL expression to run_query.php. The reflected payload executes in the browser under the iTop origin, granting access to session cookies, CSRF tokens, and any actions the victim is authorized to perform.

php

// Patch applied in pages/run_query.php
$sBefore = substr($sExpression, 0, $e->GetColumn());
$sAfter = substr($sExpression, $e->GetColumn() + strlen($sWrongWord));
$sFixedExpression = $sBefore.$sSuggestedWord.$sAfter;
- $sFixedExpressionHtml = $sBefore.'<span class="ibo-run-query--highlight">'.$sSuggestedWord.'</span>'.$sAfter;
+ $sFixedExpressionHtml = $sBefore.'<span class="ibo-run-query--highlight">'.$sSuggestedWord.'</span>'.utils::EscapeHtml($sAfter);
$sSyntaxErrorText .= "<p>Suggesting: $sFixedExpressionHtml</p>";
$oSyntaxErrorPanel->AddSubBlock(new Html($sSyntaxErrorText));

Source: Combodo iTop commit 61e5536. The fix wraps the trailing expression fragment in utils::EscapeHtml() to neutralize embedded HTML and script content.

Detection Methods for CVE-2026-30826

Indicators of Compromise

HTTP requests to pages/run_query.php containing expression parameters with <script>, onerror=, onload=, or JavaScript URI schemes.
Reflected responses from run_query.php containing unescaped HTML tags inside the "Suggesting:" message.
Unexpected outbound requests from iTop administrator browsers to attacker-controlled domains shortly after visiting a crafted iTop URL.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query parameters submitted to run_query.php for script tags and event handler attributes.
Correlate authenticated iTop sessions with outbound HTTP requests to domains not associated with the ITSM workflow.
Review application logs for OQL expressions containing HTML metacharacters submitted by non-service accounts.

Monitoring Recommendations

Enable and centralize iTop access logs, forwarding them to a SIEM for keyword and regex matching against known XSS payload patterns.
Monitor Content Security Policy (CSP) violation reports if CSP is enabled on the iTop deployment.
Track admin account activity for anomalous configuration changes that follow interaction with the query testing page.

How to Mitigate CVE-2026-30826

Immediate Actions Required

Upgrade all Combodo iTop instances to version 3.2.3 or later, which includes the sanitization fix in run_query.php.
Restrict access to the OQL query testing page to a minimal set of trusted administrators pending patch deployment.
Invalidate active administrator sessions and rotate API tokens after applying the update.

Patch Information

The official fix is included in Combodo iTop 3.2.3 and referenced in GitHub Security Advisory GHSA-m592-x5r5-w2r2. The corrective commit is 61e5536b500dbf6be3574c5517eaafea27cbfec7, which applies utils::EscapeHtml() to the reflected expression fragment.

Workarounds

Place iTop behind a WAF configured to block HTML tags and JavaScript event handlers in the expression parameter of run_query.php.
Enforce a strict Content Security Policy that disallows inline script execution to limit the impact of reflected payloads.
Train administrators to avoid clicking untrusted links that reference the iTop run_query.php endpoint.

bash

# Example nginx rule to block obvious XSS payloads targeting run_query.php
location ~ /pages/run_query\.php$ {
    if ($args ~* "(<script|onerror=|onload=|javascript:)") {
        return 403;
    }
    proxy_pass http://itop_backend;
}