# CVE-2026-33240: Combodo iTop reflected XSS in foreign key search

Source: https://junglewise.ai/threats/cve-2026-33240-combodo-itop-reflected-xss-in-foreign-key-search  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-33240 · Severity: high · CVSS 8.8 · Published 2026-08-21

Combodo iTop is an IT service management platform used to track IT assets and handle service requests. A reflected cross-site scripting vulnerability in the foreign key search API allows attackers to inject malicious scripts that execute in users' browsers when they click a crafted link, potentially stealing session credentials or performing unauthorized actions within the application.

Technologies: [Combodo iTop](https://junglewise.ai/threats/technologies/itop). Vendors: [Combodo](https://junglewise.ai/threats/vendors/combodo).

## Quick answers

**Is CVE-2026-33240 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33240 being exploited in the wild.

**How severe is CVE-2026-33240?** High severity, with a CVSS score of 8.8, published 21 August 2026.

**Which products and versions are affected?** Combodo iTop prior to 3.2.3.

**Is there a fix for CVE-2026-33240?** A patch was published on 2026-03-18: Fix committed; versions 3.2.3 and 3.3.0 contain the patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33240 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-33240?** Check whether you run Combodo iTop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected XSS vulnerability exists in iTop's foreign key search criteria API prior to version 3.2.3. The vulnerability arises from improper handling of user input in search parameters, allowing an attacker to inject JavaScript code that is reflected back to the user without sanitization. The attack requires user interaction (clicking a malicious link) and is network-accessible without requiring authentication. An attacker can craft a malicious URL to steal session tokens, modify data, or perform actions on behalf of the victim user. The issue is fixed in version 3.2.3 and later (3.3.0) through code modernization that properly handles user input.

## Affected products

- Combodo iTop prior to 3.2.3

## Timeline

- 2026-08-21: disclosed
- 2026-03-18: patched: Fix committed; versions 3.2.3 and 3.3.0 contain the patch

## References

- [https://github.com/Combodo/iTop/commit/2a16143e53b4019415db90b6ac89f16fc3f773ff](https://github.com/Combodo/iTop/commit/2a16143e53b4019415db90b6ac89f16fc3f773ff)
- [https://github.com/Combodo/iTop/security/advisories/GHSA-5hw5-fvw4-55p4](https://github.com/Combodo/iTop/security/advisories/GHSA-5hw5-fvw4-55p4)

## Related threats

- [Combodo iTop missing authorization in LinkSetController](https://junglewise.ai/threats/cve-2026-108717-combodo-itop-3-1-0-through-3-3-0-contains-a-missing)
- [Combodo iTop PHP object injection in user preferences](https://junglewise.ai/threats/cve-2026-40877-combodo-itop-php-object-injection-in-user-preferences)
- [Combodo iTop remote code execution via unsafe eval](https://junglewise.ai/threats/cve-2026-39975-combodo-itop-remote-code-execution-via-unsafe-eval)
- [Combodo iTop reflected XSS in dashboard revert](https://junglewise.ai/threats/cve-2026-30864-combodo-itop-reflected-xss-in-dashboard-revert)
- [Combodo iTop .readonly file deletion by unauthenticated users](https://junglewise.ai/threats/cve-2026-34949-combodo-itop-readonly-file-deletion-by-unauthenticated-users)