GLPI 11.0.9 fixes form-illustration cross-site scripting and two access-control flaws

What happened

GLPI's advisory GHSA-7rqw-r5p3-ff92 describes a cross-site scripting flaw in form illustration import. An authenticated user with form import permissions can inject arbitrary content into a form's custom illustration through a JSON import and trigger cross-site scripting. The flaw is rated high severity with a CVSS 4.0 score of 8.6. The vector describes a network-based attack with low attack complexity, high privileges required and no user interaction; successful exploitation can affect confidentiality, integrity and availability.

Two access-control advisories are also resolved. GHSA-5qgv-9jcx-wph7 describes how any connected user can craft a request to change the visibility of knowbase items, reminders and RSS feeds and thereby access their content; it has a CVSS 4.0 score of 5.3. GHSA-h34m-gqcf-25cp describes how an authenticated user can access followups, tasks and solutions generated from templates, potentially disclosing information from tickets, problems or changes depending on the template configuration; it also has a CVSS 4.0 score of 5.3.

GLPI's advisories do not report exploitation in the wild or public disclosure for any of the three issues.

Who is affected

The form-illustration cross-site scripting flaw affects GLPI 11.0.0 to before 11.0.9.

The knowbase/reminder/RSS feed visibility flaw affects GLPI 0.83 to before 10.0.27 and GLPI 11.0.0 to before 11.0.9.

The template-generated followups/tasks/solutions access flaw affects GLPI 9.5.0 to before 10.0.27 and GLPI 11.0.0 to before 11.0.9.

These flaws require an authenticated GLPI account. The first requires form import permissions; the second requires only a connected user; the third requires an authenticated user.

What to do now

1. For GLPI deployments on 11.0.0 to before 11.0.9, upgrade to GLPI 11.0.9. This fixes GHSA-7rqw-r5p3-ff92, GHSA-5qgv-9jcx-wph7 and GHSA-h34m-gqcf-25cp.
2. For older deployments affected by the access-control flaws, upgrade to GLPI 10.0.27. This applies to GHSA-5qgv-9jcx-wph7 on versions 0.83 to before 10.0.27, and to GHSA-h34m-gqcf-25cp on versions 9.5.0 to before 10.0.27.
3. No workarounds are listed in GLPI's advisories.

Beyond the patch

Beyond the immediate upgrade, this set of authenticated flaws shows why GLPI configuration and patch cadence matter. Implementation & Assessment Services can test an installation for injection and access-control weaknesses such as these before they become published advisories. Tracking open-source components such as GLPI and how quickly fixes are applied is a core Supply Chain Defense & Third-Party Risk exercise.