CVE-2026-30819: Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting (XSS) vulnerability in its dashboard revert functionality with the parameter dashboardid in /pages/ajax.render.php. This issue has been fixed in version 3.2.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Combodo iTopto a version that resolves this vulnerability.Fixed in 3.2.3
Event History
Frequently Asked Questions
Which deployments are affected?
iTop versions prior to 3.2.3 are affected. The issue is in the dashboard revert functionality handled by /pages/ajax.render.php and its dashboard_id parameter.
What access does an attacker need to exploit this issue?
The severity vector indicates network reachability, low privileges, and user interaction are required. An attacker would need a low-privileged account and must induce a user to interact with the crafted content or request.
What is the impact if exploitation succeeds?
Successful reflected XSS can compromise confidentiality and integrity in the affected user's browser session. The provided vector indicates no direct availability impact.
What should teams do to remediate it?
Upgrade iTop to version 3.2.3, which fixes the vulnerability.