CVE-2026-26027
published 2026-04-06CVE-2026-26027: GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory…
PriorityP428medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.19%
8.9th percentile
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. This vulnerability is fixed in 11.0.6.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| glpi-project | glpi | — | — |
| glpi-project | glpi | >= 11.0.0 < 11.0.6 | 11.0.6 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
osv6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
glpi-project glpi up to 11.0.5 Inventory Endpoint cross site scripting (GHSA-chch-wcm9-f9cp / Nessus ID 305612)
vuldb·2026-04-13·CVSS 7.5
CVE-2026-26027 [HIGH] glpi-project glpi up to 11.0.5 Inventory Endpoint cross site scripting (GHSA-chch-wcm9-f9cp / Nessus ID 305612)
A vulnerability was found in glpi-project glpi up to 11.0.5 and classified as problematic. Affected by this issue is some unknown functionality of the component Inventory Endpoint. Executing a manipulation can lead to cross site scripting.
This vulnerability is handled as CVE-2026-26027. The attack can be executed remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
OSV
CVE-2026-26027: GLPI is a free asset and IT management software package
osv·2026-04-07·CVSS 6.1
CVE-2026-26027 [MEDIUM] CVE-2026-26027: GLPI is a free asset and IT management software package
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. This vulnerability is fixed in 11.0.6.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-29047 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.2
CVE-2026-29047 [HIGH] CVE-2026-29047 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-29047 :
GLPI vulnerability analysis and mitigation
GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, an authenticated user can perform a SQL injection via the logs export feature. This vulnerability is fixed in 10.0.24 and 11.0.6.
Source : NVD
## 8.8
Score
Published April 6, 2026
Severity HIGH
CNA Score 7.2
Affected Technologies
GLPI
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 7.4
Exploitation Probability (EPSS) N/A
Affected packages and libraries
cpe:2.3:a:glpi-project:glpi
Sources
Linux Severity HIGH Has Fix Added at: Apr 09, 2026
Windows Severity HIGH Has Fix Added at: Apr 09, 2026
Linux Severity HIGH Has Fix Ad
Wiz
CVE-2026-26263 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.2
CVE-2026-26263 [HIGH] CVE-2026-26263 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-26263 :
GLPI vulnerability analysis and mitigation
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based blind SQL injection exists in GLPI's Search engine. This vulnerability is fixed in 11.0.6.
Source : NVD
## 9.8
Score
Published April 6, 2026
Severity CRITICAL
CNA Score 8.1
Affected Technologies
GLPI
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 8.3
Exploitation Probability (EPSS) N/A
Affected packages and libraries
cpe:2.3:a:glpi-project:glpi
Sources
Linux Severity CRITICAL Has Fix Added at: Apr 09, 2026
Windows Severity CRITICAL Has Fix Added at: Apr 09, 2026
Linux Severity CRITICAL Has Fix Added a
Wiz
CVE-2026-26026 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.2
CVE-2026-26026 [HIGH] CVE-2026-26026 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-26026 :
GLPI vulnerability analysis and mitigation
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in 11.0.6.
Source : NVD
## 7.2
Score
Published April 6, 2026
Severity HIGH
CNA Score 9.1
Affected Technologies
GLPI
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 14
Exploitation Probability (EPSS) N/A
Affected packages and libraries
cpe:2.3:a:glpi-project:glpi
Sources
Linux Severity HIGH Has Fix Added at: Apr 09, 2026
Windows Severity HIGH Has Fix Added at: Apr 09, 2026
Linux Severity HIGH Has Fix Added at: Apr 10, 2026
Windows Severity HIGH Has Fix
Wiz
CVE-2026-25932 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.2
CVE-2026-25932 [HIGH] CVE-2026-25932 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-25932 :
GLPI vulnerability analysis and mitigation
GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier fields. This vulnerability is fixed in 10.0.24.
Source : NVD
## 4.8
Score
Published April 6, 2026
Severity MEDIUM
CNA Score 7.2
Affected Technologies
GLPI
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 8.7
Exploitation Probability (EPSS) N/A
Affected packages and libraries
cpe:2.3:a:glpi-project:glpi
Sources
Linux Severity MEDIUM Has Fix Added at: Apr 09, 2026
Windows Severity MEDIUM Has Fix Added at: Apr 09, 2026
Linux Severity MEDIUM Has Fix Added at: Apr 10,
Wiz
CVE-2026-26027 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.2
CVE-2026-26027 [HIGH] CVE-2026-26027 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-26027 :
GLPI vulnerability analysis and mitigation
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. This vulnerability is fixed in 11.0.6.
Source : NVD
## 6.1
Score
Published April 6, 2026
Severity MEDIUM
CNA Score 7.5
Affected Technologies
GLPI
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 13
Exploitation Probability (EPSS) N/A
Affected packages and libraries
cpe:2.3:a:glpi-project:glpi
Sources
Linux Severity MEDIUM Has Fix Added at: Apr 09, 2026
Windows Severity MEDIUM Has Fix Added at: Apr 09, 2026
Linux Severity MEDIUM Has Fix Added at: Apr 10,
2026-04-06
Published