CVE-2025-27514: GLPI is susceptible to Stored XSS attack through project's kanban

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-29 · updated 2026-06-17
Weakness: CWE-79

Description

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 9.5.0 through 10.0.18, a technician can use a malicious payload to trigger a stored XSS on the project's kanban. This is fixed in version 10.0.19.

Affected products

glpi-project glpi: from 9.5.0 before 10.0.19 — fixed in 10.0.19

How to fix

Upgrade to a fixed version: glpi-project glpi 10.0.19. Check the vendor advisory for mitigations.

References

https://github.com/glpi-project/glpi/commit/c340a64a11343bde706d1cd41e4be798dd922303
https://github.com/glpi-project/glpi/security/advisories/GHSA-jh8j-gqxc-6gqj

Get alerted when CVE-2025-27514 or the next vulnerability affects your stack