PT-2026-22804 · Glpi+1 · Glpi+1

Varandaa · Published 2026-03-03 · Updated 2026-04-17 · CVE-2026-25932

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GLPI versions 0.60 through 10.0.23

Description GLPI is an Asset and IT Management Software package. An authenticated technician user can store a cross-site scripting (XSS) payload in supplier fields. This allows for potential malicious code execution within the application.

Recommendations Update to version 10.0.24 or later.

Fix

Improper Encoding or Escaping of Output

XSS

Weakness Enumeration

CWE-116

CWE-79

Related Identifiers

BDU:2026-07150

CVE-2026-25932

Affected Products

Glpi

Red Os

References · 12

• https://github.com/glpi-project/glpi/security/advisories/GHSA-m627-945g-x7xh · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07150 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25932 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-25932 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-25932 · Security Note
• https://ubuntu.com/security/CVE-2026-25932 · Vendor Advisory
• https://redos.red-soft.ru/search/?iblock_id=24&q=CVE-2026-25932 · Note
• https://twitter.com/GLPI_PROJECT/status/2028836781722849787 · Twitter Post
• https://twitter.com/infoflowcloud/status/2041173120501858445 · Twitter Post
• https://twitter.com/CVEnew/status/2041171323615875293 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-glpi-cve-2026-25932-7.3 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-glpi-cve-2026-25932-8.0 · Note