What’s Vulnerable › Vulnerabilities
CVE-2026-26027: GLPI has an Unauthenticated Stored XSS via inventory
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-06 · updated 2026-06-17
- Weakness: CWE-79
Description
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. This vulnerability is fixed in 11.0.6.
Affected products
- glpi-project glpi: from 11.0.0 before 11.0.6 — fixed in 11.0.6
How to fix
Upgrade to a fixed version: glpi-project glpi 11.0.6. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-26027 or the next vulnerability affects your stack