PT-2026-30609 · Glpi+1 · Glpi+1

Bzhunt · Published 2026-04-06 · Updated 2026-04-17 · CVE-2026-26027

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.5

Description An unauthenticated user can store a Cross-Site Scripting (XSS) payload—a technique where malicious scripts are injected into trusted websites—via the 'inventory' endpoint.

Recommendations Update to version 11.0.6.

Fix

Improper Encoding or Escaping of Output

XSS

Missing Authentication

Weakness Enumeration

CWE-116

CWE-79

CWE-306

Related Identifiers

BDU:2026-07151

CVE-2026-26027

Affected Products

Glpi

Red Os

References · 9

• https://github.com/glpi-project/glpi/security/advisories/GHSA-chch-wcm9-f9cp · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07151 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-26027 · Security Note
• https://ubuntu.com/security/CVE-2026-26027 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-26027 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26027 · Security Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-glpi-cve-2026-26027-8.0 · Note
• https://redos.red-soft.ru/search/?iblock_id=24&q=CVE-2026-26027 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-glpi-cve-2026-26027-7.3 · Note