# CVE-2026-115982: phpIPAM reflected cross-site scripting in rack link creation

Source: https://junglewise.ai/threats/cve-2026-115982-a-vulnerability-was-detected-in-phpipam-up-to-1-8-3-affected-by  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-24. Updated: 2026-10-24  
License: CC BY 4.0 with a link back

CVE-2026-115982 · Severity: medium · CVSS 4.3 · Published 2026-10-24

phpIPAM is an IP address management tool used by organizations to track and manage network infrastructure. A reflected XSS vulnerability in the rack management feature allows attackers to inject malicious JavaScript by crafting a specially-crafted link. When an authenticated administrator visits the link, the attacker can steal session credentials, expose sensitive data, or perform unauthorized actions within the phpIPAM system.

Technologies: [Phpipam](https://junglewise.ai/threats/technologies/phpipam). Vendors: [Phpipam](https://junglewise.ai/threats/vendors/phpipam).

## Quick answers

**Is CVE-2026-115982 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115982 being exploited in the wild.

**How severe is CVE-2026-115982?** Medium severity, with a CVSS score of 4.3, published 24 October 2026.

**Which products and versions are affected?** Phpipam up to 1.8.3.

**Is there a fix for CVE-2026-115982?** No fixed version is recorded yet. Validate that the deviceid parameter is numeric using is_numeric() and apply HTML escaping via escape_input() before inserting it into HTML attributes. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-115982 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-115982?** Check whether you run Phpipam at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Validate that the deviceid parameter is numeric using is_numeric() and apply HTML escaping via escape_input() before inserting it into HTML attributes.

## Technical details

The vulnerability exists in app/tools/racks/show-rack-popup.php where the deviceid POST parameter is insufficiently sanitized before being reflected into an HTML img src attribute. Although strip_tags() removes HTML tags, double quotes and event handlers are preserved, allowing injection of JavaScript code. An attacker can craft a POST request with a malicious payload that executes in the browser context of an authenticated admin user, enabling session hijacking or unauthorized actions.

## Affected products

- phpIPAM phpIPAM up to 1.8.3

## Timeline

- 2026-10-24: disclosed: Vulnerability published via GitHub Gist and CVE-2026-115982
- 2025-09-17: other: Maintainer confirmed fix will be included in next release

## References

- [https://gist.github.com/KHr00t/a7f3b2eea71d30ad7ccf65e1d47e502f](https://gist.github.com/KHr00t/a7f3b2eea71d30ad7ccf65e1d47e502f)
- [https://vuldb.com/cve/CVE-2026-115982](https://vuldb.com/cve/CVE-2026-115982)

## Related threats

- [phpIPAM missing authorization check in customer pages](https://junglewise.ai/threats/cve-2026-108720-phpipam-through-1-8-3-contains-a-missing-authorization)
- [phpIPAM authorization bypass in User API controller](https://junglewise.ai/threats/cve-2026-97818-phpipam-through-1-8-3-has-incorrect-authorization-for-id-admins)
- [phpIPAM REST API authentication bypass via cache key collision](https://junglewise.ai/threats/cve-2026-67602-phpipam-rest-api-authentication-bypass-via-cache-key-collision)
- [phpIPAM authenticated local file inclusion in API](https://junglewise.ai/threats/cve-2026-12194-phpipam-authenticated-local-file-inclusion-in-api)
- [phpIPAM cross-site scripting in Request IP form instructions](https://junglewise.ai/threats/cve-2025-61078-phpipam-cross-site-scripting-in-request-ip-form-instructions)