CVE-2026-53610: GLPI Dashboard XSS Vulnerability

CVE-2026-53610 Overview

CVE-2026-53610 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in GLPI, an open-source asset and IT management software package. The flaw affects versions 11.0.0 through 11.0.7 and resides in the dashboard component. An attacker can craft a URL that reflects attacker-controlled markup without sufficient output encoding. When an authenticated user opens the crafted link, the injected script executes in the browser within the context of the GLPI session.

Critical Impact

Successful exploitation enables session hijacking, credential theft, and unauthorized actions in the GLPI web interface under the victim's privileges.

Affected Products

• GLPI version 11.0.0 through 11.0.7
• GLPI Dashboard component (src/Glpi/Dashboard/Widget.php)
• Fixed in GLPI version 11.0.8

Discovery Timeline

• 2026-09-25 - CVE-2026-53610 published to the National Vulnerability Database
• 2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-53610

Vulnerability Analysis

The vulnerability resides in the GLPI dashboard rendering logic. User-controlled parameters passed in a crafted URL are reflected into dashboard widget output without proper HTML output encoding. A victim who clicks the attacker-supplied link triggers execution of injected JavaScript inside the dashboard page. Because the payload executes in the authenticated user's browser context, the attacker can read session data, perform actions on behalf of the user, and pivot to administrative functions if the victim holds elevated privileges.

Root Cause

The root cause is missing or inconsistent HTML entity encoding on widget parameters. Specifically, the alt attribute passed into widget rendering was emitted directly rather than being escaped. The upstream fix wraps the alt parameter with htmlescape(), matching the treatment already applied to the icon and class fields.

Attack Vector

Exploitation requires an attacker to craft a URL targeting the GLPI dashboard with a malicious payload embedded in a reflected parameter. The attacker then delivers the link to an authenticated GLPI user through phishing, chat, or a trusted web channel. User interaction is required to open the link, after which the browser renders the attacker's markup within the trusted GLPI origin.

            : "";

        $rand = (int) $p['rand'];
+        $alt = \htmlescape($p['alt']);
        $icon = \htmlescape($p['icon']);
        $class = \htmlescape($class);

Source: GLPI patch commit 9b17a3b. The patch applies htmlescape() to the alt parameter before it is emitted into dashboard HTML.

Detection Methods for CVE-2026-53610

Indicators of Compromise

• Inbound HTTP requests to GLPI dashboard endpoints containing script tags, javascript: URIs, or HTML event handlers such as onerror= and onload= in query parameters.
• Web server access logs showing unusually long or URL-encoded parameters targeting dashboard widget routes.
• Browser Content Security Policy (CSP) violation reports originating from the GLPI dashboard pages.

Detection Strategies

• Deploy web application firewall (WAF) rules that identify reflected XSS payloads in GLPI dashboard parameters.
• Review GLPI access logs for dashboard URLs containing suspicious characters including <, >, ", and %3C.
• Correlate phishing email telemetry with outbound clicks to internal GLPI URLs containing encoded script payloads.

Monitoring Recommendations

• Enable verbose HTTP request logging on the GLPI reverse proxy and retain logs for forensic review.
• Monitor authenticated GLPI sessions for anomalous API calls that follow dashboard navigation events.
• Alert on new or modified GLPI administrator accounts, API tokens, and privilege changes.

How to Mitigate CVE-2026-53610

Immediate Actions Required

• Upgrade GLPI to version 11.0.8 or later, which contains the output-encoding fix in src/Glpi/Dashboard/Widget.php.
• Invalidate active GLPI sessions and rotate API tokens after upgrading to limit the impact of any pre-patch exploitation.
• Advise GLPI users to avoid clicking dashboard links received from untrusted sources until patching is complete.

Patch Information

The fix is published in GLPI release 11.0.8. Technical details are documented in GitHub Security Advisory GHSA-76v9-ch69-g67r. The source change is available in commit 9b17a3b, which adds htmlescape() to the vulnerable widget parameter.

Workarounds

• Deploy a strict Content Security Policy that disallows inline scripts on GLPI dashboard pages to limit payload execution.
• Place GLPI behind a WAF with signatures for reflected XSS targeting dashboard routes until the upgrade is applied.
• Restrict dashboard access to trusted internal networks or VPN users where feasible to reduce external exposure.

# Verify current GLPI version and upgrade target
grep -R "GLPI_VERSION" /var/www/glpi/inc/define.php
# Expected after remediation:
# define('GLPI_VERSION', '11.0.8');