CVE-2026-31880: Combodo iTop: Reflected XSS in universal search
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Combodo iTopto a version that resolves this vulnerability.Fixed in 3.2.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs network access to an iTop instance, a low-privileged account, and user interaction. The vulnerable universal-search input must be delivered in a way that causes a user to trigger the reflected script.
Which installations need remediation?
iTop versions prior to 3.2.3 are affected. Upgrade to version 3.2.3, which contains the fix.
What is the potential impact if exploitation succeeds?
Successful reflected XSS can execute script in the affected user's browser. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability.