CVE-2026-55214 glpi-project CVE debrief

Who should care

Defenders responsible for GLPI instances, particularly those with authenticated technician access, should assess exposure and apply the patch. This includes IT management teams, security teams, and operators of GLPI instances. They should verify exposure, review the official advisory, and apply the patch to prevent exploitation. Additionally, they should monitor for suspicious activity and review compensating controls for exposed systems.

Why it matters

CVE-2026-55214 is a high-severity vulnerability in GLPI that allows for stored cross-site scripting, requiring defenders to verify exposure and apply the patch.

• Potential for stored cross-site scripting payloads to be triggered when users open affected item suppliers lists.
• Need for verification of exposure and application of the patch to prevent exploitation.
• Possible impact on data integrity and user security if left unpatched.

Technical summary

The vulnerability allows an authenticated technician to store active markup in supplier website fields, triggering a cross-site scripting payload when another user opens the affected item's suppliers list. This occurs due to insufficient input validation and sanitization in the supplier website fields. The issue is fixed in version 11.0.8, which includes patches for the vulnerability. Defenders should prioritize verifying exposure and applying the patch to prevent exploitation. The vulnerability impacts data integrity and user security if left unpatched.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows for stored cross-site scripting.

Recommended defensive actions

• Verify exposure by checking if the GLPI instance is running a vulnerable version (11.0.6 or 11.0.7) and if an authenticated technician has stored active markup in supplier website fields.
• Apply the patch by upgrading to version 11.0.8.
• Monitor for suspicious activity, such as unexpected supplier website field changes or unusual user behavior.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability is confirmed to exist in versions 11.0.6 and 11.0.7 of GLPI. Defenders should verify exposure by checking the GLPI instance version and review the official advisory for guidance. The CVE Program and NVD entries serve as primary sources for this information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.