All vulnerabilities
CVE-2026-53610GHSA-76v9-ch69-g67r

GLPI: Reflected XSS in dashboards

glpi-project glpi
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.39%Chance of exploitation activity in the next 30 days, higher than 31% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in11.0.8Fixed versionGitHub
Published25 Sep 2026Updated 29 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. This issue is fixed in version 11.0.8.

Text from CVE List

Affected versions 2

  • glpiaffected: >= 11.0.0, < 11.0.8CVE List
  • glpi, glpi>= 11.0.0GitHub

References 3