PT-2026-30609 · Glpi+1 · Glpi+1

Bzhunt · CVE-2026-26027 · Published 2026-04-06 · Updated 2026-04-17

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.5

Description An unauthenticated user can store a Cross-Site Scripting (XSS) payload—a technique where malicious scripts are injected into trusted websites—via the 'inventory' endpoint.

Recommendations Update to version 11.0.6.

Exploit

Fix

DoS

XSS

Improper Encoding or Escaping of Output

Missing Authentication

Weakness Enumeration

CWE-79

CWE-116

CWE-306

Related Identifiers

BDU:2026-07151

CVE-2026-26027

GHSA-CHCH-WCM9-F9CP

Affected Products

Glpi

Red Os

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26027.json · Exploit
• https://github.com/glpi-project/glpi/security/advisories/GHSA-chch-wcm9-f9cp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26027 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26027 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-26027 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-26027 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-26027 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07151 · Security Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-glpi-cve-2026-26027-7.3 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-glpi-cve-2026-26027-8.0 · Note
• https://redos.red-soft.ru/search/?iblock_id=24&q=CVE-2026-26027 · Note