CVE-2026-55214

EUVD-2026-87283
GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GitHub_MCNA
8.5 HIGH
NETWORK
LOW
HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Base Score
CVSS 3.x
EPSS Score
Percentile: 20.4%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
glpi-projectglpi
11.0.6 ≤
𝑥
< 11.0.8
CNA
Common Weakness Enumeration
References
https://github.com/glpi-project/glpi/commit/970786ed3b817c4c2bf90b8457b024ec566b1bfc
https://github.com/glpi-project/glpi/releases/tag/11.0.8
https://github.com/glpi-project/glpi/security/advisories/GHSA-8v8p-w8mq-wqcg