Is CVE-2026-30819 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30819 being exploited in the wild.

How severe is CVE-2026-30819?

High severity, with a CVSS score of 7.3, published 21 August 2026.

Is there a fix for CVE-2026-30819?

A patch was published on 2026-08-10: Fix released in versions 3.2.3 and 3.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-30819 attacked?

It is attacked over the network.

Am I affected by CVE-2026-30819?

Check whether you run Combodo iTop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30819: Combodo iTop reflected XSS in dashboard revert

CVE-2026-30819 · Severity: high · CVSS 7.3 · Published 2026-08-21

Combodo iTop is a web-based IT service management platform used by organizations to manage IT operations and service delivery. A reflected cross-site scripting (XSS) vulnerability in the dashboard revert functionality allows an attacker to inject malicious scripts that can steal user session data, modify displayed content, or redirect users to malicious sites when a user clicks a specially crafted link. The vulnerability requires user interaction and low-level privileges to exploit.

Technologies: Combodo iTop. Vendors: Combodo.

Quick answers

Is CVE-2026-30819 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30819 being exploited in the wild.
How severe is CVE-2026-30819?: High severity, with a CVSS score of 7.3, published 21 August 2026.
Which products and versions are affected?: Combodo iTop prior to 3.2.3.
Is there a fix for CVE-2026-30819?: A patch was published on 2026-08-10: Fix released in versions 3.2.3 and 3.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-30819 attacked?: It is attacked over the network.
Am I affected by CVE-2026-30819?: Check whether you run Combodo iTop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected XSS vulnerability exists in iTop versions prior to 3.2.3 in the /pages/ajax.render.php endpoint's dashboard revert functionality, where the dashboard_id parameter is not properly sanitized. The vulnerability is triggered via the revert_dashboard operation, which passes the unsanitized dashboard_id parameter without applying proper context-aware filtering. An attacker with low privileges can craft a malicious URL containing JavaScript payload in the dashboard_id parameter; when a victim user clicks the link, the payload executes in the victim's browser within the security context of the iTop application. The fix, released in version 3.2.3, applies proper sanitization using ENUM_SANITIZATION_FILTER_CONTEXT_PARAM to neutralize the payload.

Affected products

Combodo iTop prior to 3.2.3

Timeline

2026-08-21: disclosed: CVE-2026-30819 published
2026-08-10: patched: Fix released in versions 3.2.3 and 3.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.