GLPI 11.0.0 - Stored XSS in knowledge base

Description

GLPI 11.0.6 contains a stored cross-site scripting (XSS) vulnerability in KnowbaseItemController::content(). The /Knowbase/KnowbaseItem/{id}/Content endpoint returns the contents of glpi_knowbaseitems.answer directly in the HTTP response via return new Response($kbitem->fields['answer']); without applying output sanitization.

An authenticated attacker with the ability to create or modify knowledge base articles can store malicious HTML or JavaScript in the answer field and cause arbitrary script execution in the browser of another authorized user who accesses the affected endpoint. In contrast, the /Knowbase/KnowbaseItem/{id}/Full rendering path processes the same content through KnowbaseItem::getAnswer() and RichText::getEnhancedHtml(...), which removes dangerous attributes such as onerror.

Vulnerability

Case A: functional UI store -> raw /Content response

1. Source persistence: create KB article from standard UI (front/knowbaseitem.form.php) with answer=<img src=x onerror=alert('KB_A')>.

2. Stored value remains raw in DB (glpi_knowbaseitems.answer).

3. Sink: GET /Knowbase/KnowbaseItem/{id}/Content returns exact payload as response body.

4. Impact: stored HTML/JS attributes are exposed unfiltered to any authorized viewer of the endpoint.

Case A2: benign HTML also returned raw

1. UI article created with answer=<b>KB_A2</b>.

2. /Content response body is exactly <b>KB_A2</b>.

3. Confirms endpoint behavior is raw HTML passthrough, not escaped text.

Case B: direct DB insertion -> raw /Content response

1. Source persistence: insert KB row directly with answer=<img src=x onerror=alert('KB_DB')>.

2. Sink: /Knowbase/KnowbaseItem/{id}/Content returns exact payload.

3. Confirms exploitability does not depend on editor-side transformations.

Case B2: differential behavior with /Full

1. /Knowbase/KnowbaseItem/{id}/Full sanitizes same payload to safe output (<img src="x" loading="lazy" />).

2. This isolates the vulnerable behavior to the /Content route implementation.

Relevant code:

• src/Glpi/Controller/Knowbase/KnowbaseItemController.php:70

• src/KnowbaseItem.php:1999-2002

• templates/components/itilobject/timeline/knowledge_item.html.twig:68-73

PoC

1. Log in as an authenticated user with KB write permissions.

2. Create a KB item with a payload in answer:

<img src=x onerror=alert('KB_A')

<img src=x onerror=alert('KB_A')

<img src=x onerror=alert('KB_A')

<img src=x onerror=alert('KB_A')

3. Open:

http://localhost:8080/Knowbase/KnowbaseItem/<id>/Content

http://localhost:8080/Knowbase/KnowbaseItem/<id>/Content

http://localhost:8080/Knowbase/KnowbaseItem/<id>/Content

http://localhost:8080/Knowbase/KnowbaseItem/<id>/Content

Expected result:

• Response body returns payload unchanged.

Evidence of Exploitation

• Video of exploitation:

• Vulnerable request:

  

• XSS triggered:

  

Our security policy

We have reserved the ID CVE-2026-5385 to refer to this issue from now on.

System Information

• GLPI

• Version < 11.0.7

• Operating System: Any

References

• Github Repository: https://github.com/glpi-project

• Security: https://github.com/glpi-project/glpi/security

• Vendor Advisory: https://github.com/glpi-project/glpi/security/advisories/GHSA-2fg5-jg72-h338

• Patch: https://github.com/glpi-project/glpi/releases/tag/11.0.7

Mitigation

An updated version of GLPI is available at the vendor page.

Credits

The vulnerability was discovered by Oscar Uribe from Fluid Attacks' Offensive Team using the AI SAST Scanner.