CVE-2026-42321: GLPI has stored XSS in asset locks

Synopsis

Stored cross-site scripting (XSS) affects GLPI, the open-source IT asset management platform, in versions 10.0.4 through 10.0.24. An authenticated attacker with technician-level privileges can inject a malicious script into the asset locked tab; the payload executes in a victim's browser when they view the affected page. Successful exploitation gives the attacker full read and write access to data in the victim's browser session and can disrupt the availability of the affected interface. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the GLPI web interface over the network to inject and trigger the stored payload.

• AuthenticationRequired

  A technician-level account (low-privilege relative to admin, but still an authenticated role) is needed to store the XSS payload in the asset locked tab.

• Victim interactionRequired

  A second user, such as an administrator or another technician, must open the affected asset locked tab in their browser for the stored payload to execute.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; no race conditions or specific memory layout requirements are involved.

Blast Radius

• Reads session tokens, cookies, and any sensitive data visible in the victim's active GLPI browser session.
• Performs actions within GLPI on behalf of the victim, including modifying asset records or configuration items.
• Crashes or disrupts the victim's GLPI interface session, forcing re-authentication or data loss in unsaved forms.