CVE-2026-31880: Combodo iTop XSS Vulnerability

CVE-2026-31880 Overview

Combodo iTop is a web-based IT service management (ITSM) tool used to manage IT infrastructure, incidents, and change requests. CVE-2026-31880 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the universal search feature of iTop versions prior to 3.2.3. An authenticated attacker can craft a malicious search URL that, when opened by a victim, executes arbitrary JavaScript in the victim's browser session. The issue has been fixed in iTop 3.2.3.

Critical Impact
Successful exploitation allows attackers to hijack authenticated iTop sessions, steal credentials, and perform actions as privileged ITSM users.

Affected Products

Combodo iTop versions prior to 3.2.3
Universal search component (pages/UniversalSearch.php)
iTop deployments exposing search functionality to authenticated users

Discovery Timeline

2026-08-21 - CVE-2026-31880 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-31880

Vulnerability Analysis

The vulnerability resides in the universal search page of iTop. The oql_clause query parameter is reflected into the rendered HTML response without proper output encoding. An attacker who supplies a crafted Object Query Language (OQL) clause containing HTML or JavaScript payloads causes the browser to execute that content in the context of the iTop application.

Because iTop is an ITSM platform, sessions often belong to administrators, service desk operators, or change managers. An attacker exploiting this flaw can perform any action the victim is authorized to perform, including modifying tickets, creating users, or exfiltrating configuration management database (CMDB) data. The reflected nature of the flaw requires user interaction, typically clicking a malicious link.

Root Cause

The root cause is missing HTML output encoding when rendering the OQL filter string back to the page. In the vulnerable code path within pages/UniversalSearch.php, the result of $oFilter->ToOQL() is embedded directly into an HTML comment without sanitization, allowing an attacker to break out of the comment context and inject arbitrary markup.

Attack Vector

Exploitation requires authenticated access (PR:L) and user interaction (UI:R). The attacker crafts a URL targeting the universal search endpoint with a malicious oql_clause parameter and delivers it to an authenticated iTop user through phishing, chat, or an internal ticket. When the victim loads the URL, the injected payload executes in the browser and can issue authenticated requests to iTop on the victim's behalf.

php

// Security patch in pages/UniversalSearch.php
// N\\u00b09235 - Sanitize oql_clause query parameter in universal search page
 	$oP->SetBreadCrumbEntry($sPageId, $sLabel, '', '', 'fas fa-search', iTopWebPage::ENUM_BREADCRUMB_ENTRY_ICON_TYPE_CSS_CLASSES);
 
 	// Menu node
-	$sFilter = $oFilter->ToOQL();
+	$sFilter = utils::EscapeHtml($oFilter->ToOQL());
 	$oP->add("\n<!-- $sFilter -->\n");
 }
 $oP->add("</div>\n");

Source: Combodo iTop commit 7bfa14a. The fix wraps the OQL string in utils::EscapeHtml() before writing it to the response, neutralizing HTML metacharacters.

Detection Methods for CVE-2026-31880

Indicators of Compromise

HTTP requests to pages/UniversalSearch.php containing script tags, event handlers, or HTML entities in the oql_clause parameter
Web server access logs showing unusually long or URL-encoded oql_clause values sent to the search endpoint
Unexpected outbound requests from iTop users' browsers to attacker-controlled domains shortly after loading a search URL

Detection Strategies

Inspect web application firewall (WAF) and proxy logs for reflected XSS patterns such as <script>, onerror=, or javascript: in iTop URL parameters
Correlate authenticated iTop sessions with anomalous DOM-based network calls or session token access from browser telemetry
Alert on iTop administrative actions performed in rapid succession following the load of a universal search URL

Monitoring Recommendations

Enable verbose HTTP access logging on the iTop web server and forward logs to a centralized analytics platform
Monitor for iTop version banners still reporting versions below 3.2.3 across the estate
Track browser security telemetry for Content Security Policy (CSP) violations originating from iTop pages

How to Mitigate CVE-2026-31880

Immediate Actions Required

Upgrade all Combodo iTop instances to version 3.2.3 or later without delay
Invalidate active iTop sessions after upgrade to prevent reuse of tokens that may have been captured
Review recent audit logs in iTop for suspicious changes made by privileged accounts

Patch Information

The fix is included in Combodo iTop 3.2.3. The patch, tracked as N°9235, applies utils::EscapeHtml() to the OQL filter string before it is written to the response in pages/UniversalSearch.php. Full details are available in the GitHub Security Advisory GHSA-6qgh-xqjr-4pv7 and the upstream commit.

Workarounds

Restrict access to the universal search page through reverse proxy rules until the upgrade is applied
Deploy a WAF rule that blocks requests to UniversalSearch.php when the oql_clause parameter contains HTML control characters such as <, >, or "
Enforce a strict Content Security Policy on the iTop domain to limit inline script execution

bash

# Example nginx rule to block suspicious oql_clause values
location ~* /pages/UniversalSearch\.php {
    if ($arg_oql_clause ~* "(<|>|script|onerror|javascript:)") {
        return 403;
    }
    proxy_pass http://itop_backend;
}