CVE-2026-25932
Received Received - Intake
Stored XSS in GLPI Supplier Fields Allows Persistent Injection

Publication date: 2026-04-06

Last updated on: 2026-04-07

Assigner: GitHub, Inc.

Description
GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier fields. This vulnerability is fixed in 10.0.24.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-06
Last Modified
2026-04-07
Generated
2026-06-16
AI Q&A
2026-04-06
EPSS Evaluated
2026-06-14
NVD
CVE-2026-25932
EUVD
EUVD-2026-19245
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
glpi-project glpi From 0.60 (inc) to 10.0.24 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-25932 is a high-severity stored Cross-Site Scripting (XSS) vulnerability in the GLPI software package versions from 0.60 up to, but not including, 11.0.0.

This vulnerability allows an authenticated technician user to inject and store malicious XSS payloads within supplier fields due to improper encoding or escaping of output.

Because the product fails to correctly preserve the intended structure of messages exchanged between components, the injected scripts can be executed, leading to security risks.

Impact Analysis

This vulnerability can have serious impacts including unauthorized data access, unauthorized data modification, and potential disruption of service.

  • Confidentiality Impact: High - attackers may access sensitive data without authorization.
  • Integrity Impact: High - attackers may modify data without permission.
  • Availability Impact: High - attackers may disrupt the availability of the service.

The vulnerability can be exploited remotely over the network by an authenticated technician user without requiring additional user interaction.

Detection Guidance

This vulnerability involves an authenticated technician user injecting stored XSS payloads into supplier fields within the GLPI software. Detection would require verifying if such malicious scripts exist in supplier fields.

Since the vulnerability is related to stored XSS in supplier fields, detection can be performed by reviewing the supplier data entries for suspicious scripts or payloads.

No specific commands or automated detection tools are provided in the available resources.

Mitigation Strategies

The primary mitigation step is to upgrade the GLPI software to version 10.0.24 or later, where the vulnerability has been fixed by implementing proper output encoding and escaping to prevent stored XSS in supplier fields.

Until the upgrade can be performed, restrict technician user privileges to trusted personnel only, as the vulnerability requires authenticated technician access.

Compliance Impact

The vulnerability allows an authenticated technician to inject stored XSS payloads, which can lead to unauthorized data access, modification, and potential disruption of service.

Such impacts on confidentiality, integrity, and availability could negatively affect compliance with standards and regulations like GDPR and HIPAA that require protection of sensitive data and system integrity.

However, the provided information does not explicitly mention compliance implications or specific regulatory impacts.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-25932. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart