CVE-2026-40108: GLPI Vulnerable to Stored XSS in ITIL Costs

Synopsis

Stored cross-site scripting (XSS) in GLPI affects versions 11.0.0 through 11.0.6. An authenticated attacker with technician-level privileges can inject a malicious script into ITIL cost fields; the script executes in the browser of any user who later views that cost entry. Successful exploitation gives the attacker control over the victim's browser session, enabling data theft, account takeover, or unauthorized actions performed as the victim. A patched-image rebuild at version 11.0.7 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the GLPI web interface over the network to inject the payload and the victim must load the affected page from a networked browser.

• AuthenticationRequired

  The attacker must hold a valid technician-level account; any low-privilege technician account is sufficient to write to ITIL cost fields.

• Victim interactionRequired

  A separate user must open the poisoned ITIL cost entry in their browser for the stored script to execute, requiring a social-engineering or routine-use trigger.

• Attack complexityDetail

  Exploitation depends on environmental factors: the attacker must successfully store the payload and wait for a victim to view it, though no race condition or memory-layout constraint is involved.

Blast Radius

• Reads the authenticated victim's session token, enabling account takeover without further credentials.
• Performs actions in the GLPI interface as the victim, including modifying or deleting IT asset records and tickets.
• Exfiltrates any data visible to the victim in the current GLPI session, such as configuration details, cost records, and user contact information.
• Injects secondary payloads or redirects the victim's browser to attacker-controlled infrastructure.