CVE-2026-31803: Combodo iTop Reflected XSS Vulnerability

CVE-2026-31803 Overview

Combodo iTop is a web-based IT service management (ITSM) tool used to manage IT infrastructure, incidents, and configuration items. CVE-2026-31803 is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php affecting iTop versions prior to 3.2.3. An authenticated attacker can craft a malicious URL that, when clicked by a user, executes arbitrary JavaScript in the victim's browser session. The flaw is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation). Combodo has released iTop 3.2.3 to address the issue.

Critical Impact
Successful exploitation lets an attacker execute JavaScript in the context of an authenticated iTop user, enabling session theft, action forgery, and compromise of ITSM data confidentiality and integrity.

Affected Products

Combodo iTop versions prior to 3.2.3
The pages/tagadmin.php administration page
Deployments exposing iTop tag administration to authenticated users

Discovery Timeline

2026-08-21 - CVE-2026-31803 published to the National Vulnerability Database (NVD)
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-31803

Vulnerability Analysis

The vulnerability resides in pages/tagadmin.php, which handles tag administration within iTop. The page constructs HTML output that includes an OQL (Object Query Language) filter string derived from user-controlled input. Prior to the fix, that filter value was written into the page as an HTML comment without being escaped. An attacker who supplies a crafted filter parameter can break out of the comment context and inject arbitrary HTML or JavaScript that the victim's browser executes.

Because the payload is reflected in the response rather than stored, exploitation requires the target user to load an attacker-supplied URL. The attacker must also hold a valid low-privilege iTop session. Once triggered, the injected script runs with the privileges of the victim, including any iTop administrator viewing the crafted request.

Root Cause

The root cause is missing output encoding. The $sFilter string produced by $oFilter->ToOQL() was concatenated directly into HTML without HTML-entity escaping. The patch introduces utils::EscapeHtml($sFilter) before the value is written to the response, neutralizing angle brackets and quote characters that would otherwise close the surrounding comment or attribute context.

Attack Vector

Exploitation occurs over the network against an authenticated iTop instance. The attacker crafts a URL to pages/tagadmin.php containing an OQL-style payload that, when rendered, escapes the HTML comment boundary and introduces a <script> tag or event-handler attribute. Delivery typically relies on phishing, chat messages, or embedded links within trusted ITSM workflows. User interaction is required to trigger the reflected payload.

php

// Patch from Combodo/iTop commit ab8e7bd15ed251ad4fbe8d4d1b17474b2d688fba
// pages/tagadmin.php - N°9236 tag admin fix (#832)

// Menu node
$sFilter = $oFilter->ToOQL();
+$sFilter = utils::EscapeHtml($sFilter);
$oP->add("\n<!-- $sFilter -->\n");

Source: Combodo/iTop commit ab8e7bd. The added utils::EscapeHtml call converts reserved HTML characters to their entity equivalents before rendering, preventing the attacker-controlled string from altering the HTML structure.

Detection Methods for CVE-2026-31803

Indicators of Compromise

HTTP requests to pages/tagadmin.php containing URL-encoded <, >, script, onerror, onload, or javascript: substrings in query parameters.
Referrer or access logs showing external origins linking directly to tagadmin.php with unusual query strings.
Web server responses reflecting suspicious payloads inside HTML comments near the tag admin menu node.

Detection Strategies

Inspect iTop web access logs for GET/POST requests to pages/tagadmin.php with parameters containing HTML metacharacters or common XSS keywords.
Deploy Web Application Firewall (WAF) signatures for reflected XSS patterns targeting the iTop tag admin endpoint.
Correlate authenticated session activity with anomalous outbound requests from browsers that recently visited tagadmin.php, which may indicate token exfiltration.

Monitoring Recommendations

Alert on repeated 200-status responses from tagadmin.php where request parameters include encoded script tags or event handlers.
Monitor iTop admin accounts for unexpected configuration changes, new privileged users, or API tokens created shortly after a tagadmin.php request.
Enable and centralize browser Content Security Policy (CSP) violation reports for the iTop origin to detect script injection attempts.

How to Mitigate CVE-2026-31803

Immediate Actions Required

Upgrade all Combodo iTop instances to version 3.2.3 or later, which contains the utils::EscapeHtml fix.
Restrict access to pages/tagadmin.php to trusted administrative networks using reverse proxy or firewall rules until the upgrade completes.
Invalidate active administrator sessions and rotate API tokens if request logs show suspicious activity against the tag admin endpoint.

Patch Information

The vulnerability is fixed in Combodo iTop 3.2.3. The upstream fix is committed in Combodo/iTop commit ab8e7bd and documented in the GitHub Security Advisory GHSA-m27p-8qgh-857g. Administrators should follow Combodo's standard upgrade procedure and clear compiled dictionaries and caches after upgrading.

Workarounds

Apply the upstream patch to pages/tagadmin.php manually if an immediate version upgrade is not possible.
Enforce a strict Content Security Policy that disallows inline scripts on the iTop origin to reduce the impact of reflected payloads.
Deploy WAF rules that block requests to pages/tagadmin.php containing HTML metacharacters or known XSS keywords.

bash

# Example nginx rule to block obvious XSS payloads against tagadmin.php
location /pages/tagadmin.php {
    if ($args ~* "(<|%3C)\s*script|onerror=|onload=|javascript:") {
        return 403;
    }
    proxy_pass http://itop_backend;
}