CVE-2026-53987: GLPI 11 before 2.14.4 Tag Plugin Stored Cross-Site Scripting in Kanban Badge Rendering
The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent() without output escaping, resulting in stored cross-site scripting. An authenticated user with TAG MANAGEMENT create or update rights can set a tag name containing HTML, which then executes in the browser of any user who opens the Kanban view of a ticket, problem, change, or project the tag is attached to.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GLPI 11 Tag Pluginto a version that resolves this vulnerability.Fixed in 2.14.4 - Configuration
Update the Tag plugin so tag names are stored with HTML sanitization and rendered in the Kanban badge markup with proper output escaping (PluginTagTag::preKanbanContent()) to prevent stored XSS.
GLPI 11 Tag Plugin PluginTagTag::preKanbanContent() output handling = Enable HTML sanitization/output escaping for stored tag names in Kanban badge rendering
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53987?
The severity of CVE-2026-53987 is rated medium, with a score of 6.4.
How do I fix CVE-2026-53987?
To fix CVE-2026-53987, upgrade to GLPI version 2.14.4 or later.
What types of attacks are possible with CVE-2026-53987?
CVE-2026-53987 allows for stored cross-site scripting (XSS) attacks if exploited.
Who is affected by CVE-2026-53987?
Authenticated users with TAG MANAGEMENT create or update rights in GLPI 11 before version 2.14.4 are affected by CVE-2026-53987.
What is the main cause of CVE-2026-53987?
The main cause of CVE-2026-53987 is the lack of HTML sanitization and output escaping when rendering tag names in Kanban badges.