CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

GLPI < 10.0.25 / 11.0.7 XSS (CERTFR-2026-AVI-0551)

cve · CVE-2026-42321 single-source

Coverage
1
first 2026-05-08 → last 2026-10-21
Latest activity
2026-05-08
GLPI patches stored XSS and missing-authorization flaws in 10.0.25 and 11.0.7; no exploitation reported
Peak priority
routine
1 routine
Targets
·
regions: europe
Sources cited
10
2 hosts

Defender insights

What each entry about CVE-2026-42321 tells a defender to do, newest first.

2026-05-08ROUTINEGLPI patches stored XSS and missing-authorization flaws in 10.0.25 and 11.0.7; no exploitation reported

Exposure

Story timeline

  1. 2026-05-08GLPI 10.0.25 and 11.0.7 fix seven CVEs: three stored XSS flaws and missing-authorization bugs that let users delete files and items
    trending-vulnerabilitiesGLPI patches stored XSS and missing-authorization flaws in 10.0.25 and 11.0.7; no exploitation reported

Hunting pivots

Tags
patch-availablevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter: JavaScript

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-08/glpi-certfr-2026-avi-0551-seven-cves-including-ssrf-and-xss · ATT&CK page ↗

Execution TA0002

T1059.007Command and Scripting Interpreter: JavaScript×1

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.

Evidence: 2026-05-08/glpi-certfr-2026-avi-0551-seven-cves-including-ssrf-and-xss · ATT&CK page ↗

Entries about GLPI < 10.0.25 / 11.0.7 XSS (CERTFR-2026-AVI-0551) (1)

2026-05-08 · view entry permalink →

ROUTINECVE-2026-32312 +6updatedNATOA2

GLPI 10.0.25 and 11.0.7 fix seven CVEs: three stored XSS flaws and missing-authorization bugs that let users delete files and items

GLPI released versions 11.0.7 and 10.0.25 on 2026-04-29 as security releases (GLPI, 2026-04-29) (GLPI, 2026-04-29). The CVE-assigned fixes are three stored cross-site scripting flaws rated High, in the knowledge base (CVE-2026-5385, listed in both branches' release notes), in ITIL costs (CVE-2026-40108, 11.x) and in asset locks (CVE-2026-42321, 10.x); arbitrary file deletion by a technician (CVE-2026-42317, High) and arbitrary item deletion via planning (CVE-2026-42318, High); arbitrary file access (CVE-2026-42320, Medium); and an unauthorized export of form structure (CVE-2026-32312, Medium, 11.x) (GLPI, 2026-04-29) (GLPI, 2026-04-29). The knowledge-base flaw's own advisory gives only 11.0.0 and later as affected, patched in 11.0.7 (GLPI, GHSA-2fg5-jg72-h338), and the asset-lock flaw affects 10.0.4 and later on the 10.x branch (GLPI, GHSA-hwjc-8228-55x4). GLPI's per-CVE advisories score the seven flaws from 5.1 to 8.4 under CVSS 4.0 (GLPI, GHSA-cg63-qchq-q626) (GLPI, GHSA-2fg5-jg72-h338) (GLPI, GHSA-w7mr-3vwm-2j22) (GLPI, GHSA-hwjc-8228-55x4) (GLPI, GHSA-rhmv-j773-4gvh) (GLPI, GHSA-jf72-cvjh-px5w) (GLPI, GHSA-58j6-94cf-gcx5). CERT-FR relayed the releases in CERTFR-2026-AVI-0551 on 2026-05-07, covering GLPI before 10.0.25 and before 11.0.7 (CERT-FR, 2026-05-07). No source reports exploitation.

Correctionrun 2026-10-11T1307Z-audittitleheadlinesummaryevent_dateprioritycvestechniquessourcesverificationclassificationbody

GLPI's release notes classify the seven CVEs as stored cross-site scripting (CVE-2026-5385, CVE-2026-40108, CVE-2026-42321), arbitrary file and item deletion (CVE-2026-42317, CVE-2026-42318), arbitrary file access (CVE-2026-42320) and an unauthorized export of form structure (CVE-2026-32312) (GLPI, 2026-04-29) (GLPI, 2026-04-29). The earlier text called CVE-2026-32312 an SSRF, listed four of the CVEs as stored or reflected XSS, and described CVE-2026-5385 as a policy bypass and CVE-2026-40108 as a data-integrity flaw. CERT-FR published its advisory on 2026-05-07 (CERT-FR, 2026-05-07); 2026-04-29 is the date of GLPI's releases. GLPI's per-CVE advisories do carry CVSS 4.0 scores, from 5.1 to 8.4 (GLPI, GHSA-cg63-qchq-q626) (GLPI, GHSA-2fg5-jg72-h338), and the stored XSS risk sits with the privileged accounts that can write the affected content.

Improvementrun 2026-10-21T1149Z-auditcvesbody

The release notes for both 10.0.25 and 11.0.7 list the knowledge-base stored XSS, CVE-2026-5385 (GLPI, 2026-04-29) (GLPI, 2026-04-29), but its advisory gives only 11.0.0 and later as affected, patched in 11.0.7 (GLPI, GHSA-2fg5-jg72-h338); upgrading both branches covers either reading. The asset-lock stored XSS, CVE-2026-42321, affects 10.0.4 and later on the 10.x branch (GLPI, GHSA-hwjc-8228-55x4).

vulnerability08 May 05:00Zsingle-sourceOpen finding →
Sources: GLPI · CERT-FR

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • github.com9 (90%)
  • cert.ssi.gouv.fr1 (10%)

External references

NVD · cve.org · CISA KEV

All cited sources (10)