PT-2025-11260 · Glpi · Glpi Inventory Plugin

Published 2025-03-14 · Updated 2025-03-14 · CVE-2025-26626

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: GLPI Inventory Plugin versions prior to 1.5.0

Description: The issue concerns the GLPI Inventory Plugin, which is part of the GLPI asset and IT management software package. It handles various tasks for GLPI agents. The problem is related to reflective cross-site scripting, which could lead to the execution of javascript code.

Recommendations: For versions prior to 1.5.0, update to version 1.5.0 to resolve the issue. As a temporary workaround, consider restricting access to the plugin to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-26626

GHSA-8P38-R7VF-J6JX

Affected Products

Glpi Inventory Plugin

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26626.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-26626 · Security Note
• https://osv.dev/vulnerability/CVE-2025-26626 · Vendor Advisory
• https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-8p38-r7vf-j6jx · Note
• https://github.com/glpi-project/glpi-inventory-plugin/blob/1.5.0/CHANGELOG.md#150---2025-02-25 · Note
• https://twitter.com/CVEnew/status/1900538664523882696 · Twitter Post
• https://t.me/cvedetector/20304 · Telegram Post
• https://t.me/cvetracker/19119 · Telegram Post