CVE-2026-5385: GLPI 11.0.0 - Stored XSS in knowledge base

Synopsis

Stored cross-site scripting (XSS) in GLPI's knowledge base allows an attacker with write access to the knowledge base to inject malicious scripts into knowledge base items. The vulnerability is reachable over the network and requires a high-privilege account to create or edit knowledge base entries; exploitation is triggered when another user views the poisoned item. Successful exploitation gives the attacker full read and write access to data in the victim's browser session, and can disrupt the victim's use of the application. A patched-image rebuild at version 11.0.7 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the GLPI knowledge base interface over the network; the service must be exposed to an accessible network endpoint.

• AuthenticationRequired

  A high-privilege account with write access to the knowledge base is needed to store the malicious payload.

• Victim interactionRequired

  A separate user must open and view the poisoned knowledge base item, making this a social-engineering or passive-wait scenario.

• Attack complexityDetail

  The exploit is reliable and condition-free once the attacker has the required account; no race conditions or specific memory layout are involved.

Blast Radius

• Reads sensitive data accessible in the victim's browser session, including session tokens, credentials auto-filled by the browser, and any GLPI data rendered on the page.
• Performs actions in GLPI on behalf of the victim, including modifying records, creating users, or changing configuration, at whatever privilege level the victim holds.
• Disrupts the victim's active session by redirecting the browser, logging the user out, or rendering the application unusable for that session.