CVE-2026-55214

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55214

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55214.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-55214

Aliases

GHSA-8v8p-w8mq-wqcg

Published

2026-09-25T18:33:03Z

Modified

2026-09-27T03:47:32Z

Severity

8.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

GLPI: Stored XSS in suppliers

Details

GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-116"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55214.json"
}

References

Affected packages

Git / github.com/glpi-project/glpi

Affected ranges

Type

GIT

Repo

https://github.com/glpi-project/glpi

Events

Introduced

a88bef96c03a0713f53916651bb166eb1cba7828

Fixed

970786ed3b817c4c2bf90b8457b024ec566b1bfc

Fixed

1056d00af818ad2a99e3009a21a9db8c724ddc53

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "11.0.6"
        },
        {
            "fixed":  "11.0.8"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

11.*

11.0.6

11.0.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55214.json"