Read the docs
TI-2026-38943 Aliases CVE-2026-53987GHSA-qc6r-wrm6-23pm

Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering

Priority LOW 35CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent() without output escaping, resulting in stored cross-site scripting. An authenticated user with TAG MANAGEMENT create or update rights can set a tag name containing HTML, which then executes in the browser of any user who opens the Kanban view of a ticket, problem, change, or project the tag is attached to.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00503 43rd percentileScored 2026-11-07
Fix Fixed tag (pluginsGLPI): 2.14.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pluginsGLPItag2.6.0 to before 2.14.42.14.4Patch availableCNA
  • tag VendorpluginsGLPI Affected 2.6.0 to before 2.14.4 Fixed in 2.14.4 Patch available CNA

Remediation

  • Fix · CNA tag (pluginsGLPI) Fixed in 2.14.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53987
  2. 2026-10-03 Alias added: GHSA-qc6r-wrm6-23pm
  3. 2026-10-29 Title updated · CNA
  4. 2026-10-29 Fix available: pluginsGLPI/[email protected] · CNA

References

Patch 2

Advisory 1

Other 1

  • TI-2024-36046 The Addressing GLPI plugin allows data enumeration through uncontrolled object instantiation CVSS 3.1HIGH 8.2
  • TI-2025-20010 Escalade GLPI Plugin Vulnerable to Improper Access Control CVSS 3.1MEDIUM 6.5
  • TI-2026-09772 GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import CVSS 4.0HIGH 7.1
  • TI-2024-30621 Fields GLPI plugin has an Authenticated SQL Injection CVSS 3.1HIGH 7.7
  • TI-2025-40221 GLPI Database Inventory Plugin Vulnerable to Stored Object Injection CVSS 3.1MEDIUM 6.4
  • TI-2025-33324 pluginsGLPI's Database Inventory Plugin allows any authenticated user to send agent requests CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences