CVE-2026-53610

Deferred Deferred - Pending Action

Reflected XSS in GLPI Dashboard

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. This issue is fixed in version 11.0.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-53610

Affected Vendors & Products

Vendor	Product	Version / Range
glpi	glpi	From 11.0.0 (inc) to 11.0.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a reflected cross-site scripting (XSS) issue in GLPI, an IT asset management software. It allows an attacker to craft a malicious URL that, when opened by a user, executes attacker-controlled scripts in the user's browser within the context of the GLPI dashboard.

Detection Guidance

To detect this vulnerability, check if your GLPI instance is running a version between 11.0.0 and 11.0.7. Inspect network traffic for suspicious URLs pointing to GLPI dashboards. Look for unexpected script execution in user sessions.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of the user, or redirect the user to malicious websites. This could lead to unauthorized access to sensitive data or account takeover if the user has elevated privileges.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR or HIPAA requirements for data protection and confidentiality. Organizations using vulnerable versions of GLPI may face compliance violations and potential fines.

Mitigation Strategies

Upgrade GLPI to version 11.0.8 or later immediately. If upgrading is not possible, restrict access to dashboard URLs and monitor for unusual activity. Apply input validation and output encoding to user-controlled inputs.

Hi! I’m here to help you understand CVE-2026-53610. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70