MajorCritical vulnerability

CVE-2026-55214 (CVSS 8.5)

NVD · officialPublished Sep 25, 2026Risk 37/100

GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8.

Technical details

CVSS

8.5

AV:NetworkAC:LowPR:HighUI:Passive

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source