Executive brief
GLPI is an open-source IT asset management platform used by organizations to track hardware and software inventory. A security vulnerability allows a technician to inject malicious scripts into the 'asset locked' tab of the management interface. If another user views this tab, the script could execute, potentially leading to unauthorized data access or administrative account takeover.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in GLPI versions 10.0.4 through 10.0.24. The flaw is rooted in the improper neutralization of input and incorrect encoding of output (CWE-79, CWE-116) within the 'asset locked' tab component. An attacker with technician-level privileges (High Privileges) can inject a malicious payload that persists in the database. When an administrative user interacts with the affected UI element, the payload executes in their browser context, allowing for session hijacking or unauthorized actions. The issue is patched in versions 10.0.25 and 11.0.7.
Affected products
- glpi-project GLPI >= 10.0.4, < 11.0.0
Timeline
- 2026-06-01: advisory: GitHub Security Advisory published
- 2026-06-03: disclosed: NVD publication date