CVE-2026-26027: GLPI has an Unauthenticated Stored XSS via inventory
Published Apr 6, 2026
·Updated
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. This vulnerability is fixed in 11.0.6.
Affected Software
1 affected component
GLPI-PROJECT GLPI>=11.0.0<11.0.6
Event History
Apr 6, 2026
CVE Published
via MITRE·02:35 PM
Data Sourced
via MITRE·02:35 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeaknessAffected Software