CVE-2021-21325: Stored XSS in budget type

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-08 · updated 2026-06-17
Weakness: CWE-79

Description

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 a new budget type can be defined by user. This input is not correctly filtered. This results in a cross-site scripting attack. To exploit this endpoint attacker need to be authenticated. This is fixed in version 9.5.4.

Affected products

glpi-project glpi: before 9.5.4 — fixed in 9.5.4

How to fix

Upgrade to a fixed version: glpi-project glpi 9.5.4. Check the vendor advisory for mitigations.

References

https://github.com/glpi-project/glpi/releases/tag/9.5.4
https://github.com/glpi-project/glpi/security/advisories/GHSA-m574-f3jw-pwrf
https://github.com/glpi-project/glpi/releases/tag/9.5.4
https://github.com/glpi-project/glpi/security/advisories/GHSA-m574-f3jw-pwrf

Get alerted when CVE-2021-21325 or the next vulnerability affects your stack