CVE-2026-26027

6.1 mediumEPSS 0.2%

Medium (6.1) in glpi-project glpi. EPSS 0.2% chance of exploitation in the next 30 days.

GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. This vulnerability is fixed in 11.0.6.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 8% of CVEs (scores of 2026-10-31)
CWEs: CWE-79, CWE-116, CWE-306
Published: 2026-04-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

glpi-project:glpi

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-chch-wcm9-f9cp

Check your stack JSON