Executive brief
The Tag plugin for GLPI, a tool used for organizing assets and tickets, contains a security flaw that allows malicious code to be stored within tag names. An attacker with permission to manage tags can inject scripts that will automatically run in the browsers of other staff members when they view project boards or ticket summaries. This could lead to unauthorized actions being performed on behalf of legitimate users or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Tag plugin for GLPI 11 (versions 2.6.0 through 2.14.3). The root cause is the lack of HTML sanitization and output escaping in the `PluginTagTag::preKanbanContent()` function when rendering tag names into Kanban badge markup. An authenticated attacker with 'TAG MANAGEMENT' create or update privileges can inject malicious HTML/JavaScript into a tag name. This payload executes in the context of any user who views the Kanban board for a ticket, problem, change, or project associated with that tag. The issue is resolved in version 2.14.4.
Affected products
- pluginsGLPI Tag plugin for GLPI 11 >= 2.6.0, < 2.14.4
Timeline
- 2026-06-24: patched: Version 2.14.4 released to address the vulnerability.
- 2026-07-09: disclosed: CVE-2026-53987 published.