CVE-2026-55214: GLPI Asset Management XSS Vulnerability

CVE-2026-55214 Overview

CVE-2026-55214 is a stored cross-site scripting (XSS) vulnerability in GLPI, an open-source IT asset and service management platform. The flaw affects versions 11.0.6 through 11.0.7. An authenticated technician can inject active markup into supplier website fields. The payload executes when any user opens the affected item's suppliers list. The vulnerability is tracked under CWE-116: Improper Encoding or Escaping of Output and is fixed in GLPI 11.0.8.

Critical Impact
Any authenticated user viewing a supplier list can trigger attacker-controlled JavaScript, enabling session hijacking, privileged action abuse, and lateral movement within the GLPI tenant.

Affected Products

GLPI version 11.0.6
GLPI version 11.0.7
GLPI versions prior to 11.0.8

Discovery Timeline

2026-09-25 - CVE-2026-55214 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-55214

Vulnerability Analysis

The vulnerability resides in GLPI's supplier rendering logic within src/Contact_Supplier.php and src/Contract_Supplier.php. When a supplier record has an empty website_url but a populated website string, the application previously emitted the raw website value directly into HTML output. Any user with technician-level permissions could store HTML or JavaScript in that field. When another user opened the suppliers list for an affected item, the stored markup rendered in the browser session.

Stored XSS in a management console provides a reliable foothold for internal attacks. Payloads can hijack administrator sessions, invoke GLPI API endpoints under the victim's privileges, or pivot to backend ticketing data.

Root Cause

The root cause is missing output encoding on a conditional code path. The template correctly applied htmlescape() when wrapping the website in an anchor tag, but omitted encoding on the fallback branch that printed the field without a hyperlink. This asymmetric sanitization allowed malicious markup to survive to the DOM.

Attack Vector

Exploitation requires an authenticated account with permission to edit supplier records. The attacker stores an XSS payload in the supplier's website field without providing a website_url. Any downstream user who opens the suppliers list for an item linked to that supplier executes the payload in their browser context.

php

// Patch applied in src/Contact_Supplier.php and src/Contract_Supplier.php
$website = $website_url !== ''
    ? "<a target=_blank href='" . htmlescape($website_url) . "'>" . htmlescape($data["website"]) . "</a>"
-    : $data["website"];
+    : htmlescape($data["website"]);

Source: GLPI commit 970786e

Detection Methods for CVE-2026-55214

Indicators of Compromise

Supplier records with website field values containing <script>, onerror=, onload=, javascript:, or other HTML event handlers.
Supplier entries where the website field holds markup while website_url is empty.
Audit log entries showing technician accounts modifying supplier records followed by unexpected administrative API calls.

Detection Strategies

Query the GLPI database for supplier rows where website contains HTML special characters: SELECT id, name, website FROM glpi_suppliers WHERE website REGEXP '[<>"'']';.
Review web server access logs for POST requests to /front/supplier.form.php from technician accounts, followed by GET requests to supplier listing pages from higher-privileged users.
Correlate browser Content Security Policy (CSP) violation reports with the supplier listing URL paths.

Monitoring Recommendations

Enable GLPI's historical change tracking on supplier records to capture before-and-after values of the website field.
Alert on supplier field modifications performed outside of normal business hours or by accounts that do not routinely manage vendor data.
Monitor outbound requests from browsers accessing the GLPI console for connections to unknown domains, which may indicate exfiltration via XSS.

How to Mitigate CVE-2026-55214

Immediate Actions Required

Upgrade GLPI to version 11.0.8 or later, which contains the patch from commit 970786e.
Audit existing supplier records for malicious markup in the website field and sanitize or remove suspicious entries.
Review technician-tier account activity for signs of unauthorized supplier record modification.

Patch Information

The fix is published in GLPI release 11.0.8 and documented in GitHub Security Advisory GHSA-8v8p-w8mq-wqcg. The patch adds htmlescape() to the fallback output branch in Contact_Supplier.php and Contract_Supplier.php, ensuring all paths encode user-controlled content before rendering.

Workarounds

Restrict the technician profile's rights to update supplier records until the upgrade is deployed.
Deploy a Content Security Policy (CSP) that blocks inline script execution on the GLPI web console.
Place a web application firewall (WAF) rule in front of GLPI that inspects POST bodies to supplier endpoints for HTML tags in the website parameter.

bash

# Verify the running GLPI version and confirm the patch is applied
grep -n 'htmlescape($data\["website"\])' /var/www/glpi/src/Contact_Supplier.php
grep -n 'htmlescape($data\["website"\])' /var/www/glpi/src/Contract_Supplier.php

# Expected: both files show htmlescape() wrapping the fallback branch output