CVE-2026-55214
GLPI is a free asset and IT management software package
- Risk score
- 55/100
- CVSS
- 8.5 v4.0
- Exploit chance (30 days)
- 0.3%
- Published
- 25 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8.
- Affected
- See advisory
- Fix
- Upgrade the product to 11.0.8 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.5 high
References
Original description
GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8.
Last activity 25 Sep 2026. Patch Forecast updates every hour.