CVE-2026-30865: Combodo iTop Dashboard XSS Vulnerability

CVE-2026-30865 Overview

Combodo iTop is a web-based IT service management (ITSM) tool used by enterprises to manage IT operations, configuration items, and service tickets. A Reflected Cross-Site Scripting (XSS) vulnerability affects the dashboard save functionality in versions prior to 3.2.3. An attacker can craft a malicious URL that, when visited by an authenticated user, executes attacker-controlled JavaScript in the victim's browser session. The flaw is tracked as [CWE-79] Improper Neutralization of Input During Web Page Generation. Combodo resolved the issue in iTop 3.2.3.

Critical Impact
An attacker can steal session tokens, perform actions on behalf of authenticated iTop users, or pivot into the ITSM environment by tricking a user into clicking a crafted link.

Affected Products

Combodo iTop versions prior to 3.2.3
iTop dashboard save functionality (pages/ajax.render.php)
Deployments exposing the iTop web interface to untrusted networks

Discovery Timeline

2026-08-21 - CVE-2026-30865 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-30865

Vulnerability Analysis

The vulnerability resides in the dashboard reload logic within pages/ajax.render.php. The server-side PHP code assembled an inline JavaScript block that embedded the dashboard_id and reload_url values directly into a $.post() payload. Because these values were interpolated into JavaScript string literals without JSON encoding or context-aware escaping, an attacker could break out of the string context and inject arbitrary script content.

Exploitation requires a victim to load a crafted URL containing the malicious dashboard_id or reload_url parameter. The injected payload executes with the privileges of the authenticated iTop user, giving the attacker access to session cookies, dashboard data, and any ITSM operation the user can perform. Because iTop stores configuration management database (CMDB) records and change management workflows, a successful XSS chain can be leveraged to alter tickets or exfiltrate infrastructure metadata.

Root Cause

The root cause is unsanitized interpolation of user-controllable parameters into a dynamically generated JavaScript block. The original code embedded {$sDashboardId} and {$sReloadURL} inside single-quoted JavaScript strings, allowing quote-breaking payloads to inject executable code.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL targeting the vulnerable dashboard endpoint, then delivers it via phishing, chat, or a compromised page. When an authenticated iTop user follows the link, the injected script runs in the iTop origin.

php

// Security patch in pages/ajax.render.php
// N°8601 N°8603 dashboards issues (#813)
} else {
+    $sDashboardIdEncoded = json_encode($sDashboardId);
+    $sReloadURLEncoded = json_encode($sReloadURL);
     $oPage->add_script(
         <<<JS
         $('.ibo-dashboard#{$sDashboardDivId}').block();
         $.post(GetAbsoluteUrlAppRoot()+'pages/ajax.render.php',
-           { operation: 'reload_dashboard', dashboard_id: '{$sDashboardId}', file: '{$sDashboardFile}', extra_params: {$sJSExtraParams}, reload_url: '{$sReloadURL}'},
+           { operation: 'reload_dashboard', dashboard_id: {$sDashboardIdEncoded}, file: '{$sDashboardFile}', extra_params: {$sJSExtraParams}, reload_url: {$sReloadURLEncoded}},
            function(data){
              $('.ibo-dashboard#{$sDashboardDivId}').html(data);
              $('.ibo-dashboard#{$sDashboardDivId}').unblock();

Source: Combodo iTop patch commit 330539a. The fix wraps both values with json_encode(), producing properly quoted and escaped JavaScript literals that cannot break out of their string context.

Detection Methods for CVE-2026-30865

Indicators of Compromise

Requests to pages/ajax.render.php containing <script>, onerror=, javascript:, or URL-encoded equivalents in the dashboard_id or reload_url parameters.
Referrer headers pointing to external phishing infrastructure preceding iTop dashboard requests.
Anomalous outbound requests from authenticated iTop user sessions to attacker-controlled domains.

Detection Strategies

Inspect web server and reverse proxy logs for suspicious query strings targeting iTop dashboard endpoints, particularly the dashboard_id and reload_url parameters.
Deploy web application firewall (WAF) rules that flag XSS payload signatures in requests to /pages/ajax.render.php.
Correlate iTop application logs with browser Content Security Policy (CSP) violation reports to identify blocked script execution attempts.

Monitoring Recommendations

Alert on iTop user sessions that generate unexpected cross-origin fetches or DOM modifications immediately after loading a dashboard.
Monitor for privileged iTop actions (mass CMDB edits, user role changes) originating shortly after a user follows an external link.
Track version banners exposed by iTop instances to identify unpatched deployments across the estate.

How to Mitigate CVE-2026-30865

Immediate Actions Required

Upgrade all Combodo iTop instances to version 3.2.3 or later.
Invalidate active iTop sessions after patching to force re-authentication.
Review dashboard configurations and audit logs for suspicious modifications made in the exposure window.

Patch Information

Combodo released the fix in iTop 3.2.3. The patch, published in commit 330539a, applies json_encode() to dashboard_id and reload_url before embedding them in generated JavaScript. Additional details are available in the GitHub Security Advisory GHSA-8j4q-ccr6-wpmj.

Workarounds

Restrict access to the iTop web interface using VPN or IP allowlisting until the patch is applied.
Deploy a strict Content Security Policy that blocks inline script execution and unsanctioned script sources.
Configure WAF rules to reject requests to pages/ajax.render.php containing HTML or JavaScript metacharacters in dashboard parameters.

bash

# Example WAF rule (ModSecurity) to block XSS payloads targeting iTop dashboard params
SecRule REQUEST_URI "@contains /pages/ajax.render.php" \
    "chain,phase:2,deny,status:403,id:2026030865,\
     msg:'Potential CVE-2026-30865 iTop dashboard XSS'"
    SecRule ARGS:dashboard_id|ARGS:reload_url "@rx (?i)(<script|javascript:|onerror=|onload=)" \
        "t:none,t:urlDecodeUni"