CVE-2026-55214

Deferred Deferred - Pending Action

Stored XSS in GLPI Supplier Website Fields

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-55214

Affected Vendors & Products

Vendor	Product	Version / Range
glpi	glpi	From 11.0.6 (inc) to 11.0.8 (inc)
glpi	glpi	11.0.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in GLPI, an IT asset management software. An authenticated technician can inject malicious scripts into supplier website fields between versions 11.0.6 and 11.0.8. When other users view the suppliers list for an affected item, the payload executes.

Detection Guidance

Since this is a stored XSS vulnerability in GLPI's supplier website fields, detection requires checking for malicious markup in those fields. Manually review supplier entries in the GLPI admin panel for unusual JavaScript or HTML code. No specific commands are provided in the context.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or redirect users to malicious sites. Users with access to sensitive data in GLPI could have their sessions compromised, leading to unauthorized access or data theft.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face compliance violations, fines, or reputational damage if exploited.

Mitigation Strategies

Upgrade GLPI to version 11.0.8 or later to patch the vulnerability. If immediate upgrade is not possible, restrict technician access to trusted users and monitor supplier field entries for suspicious content.

Hi! I’m here to help you understand CVE-2026-55214. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70