CVE-2026-26027 — GLPI has an Unauthenticated Stored XSS via inventory

CVE-2026-26027

GLPI has an Unauthenticated Stored XSS via inventory PUBLISHED

Description (CNA)

GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. This vulnerability is fixed in 11.0.6.

Affected (CNA)

Vendor / product	Versions
glpi-project / glpi	affected >= 11.0.0, < 11.0.6

CWE

CWE-79, CWE-116, CWE-306

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-chch-wcm9-f9cp

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.