CVE-2026-53987: GLPI Tag Plugin Stored XSS Vulnerability – Patch Guidance

Technical summary

CVE-2026-53987 is a stored XSS vulnerability in the GLPI Tag plugin versions before 2.14.4. The vulnerability stems from two security gaps: (1) the tag name is stored without HTML sanitization, and (2) the PluginTagTag::preKanbanContent() function renders the tag name into Kanban badge markup without output escaping. An authenticated attacker with TAG MANAGEMENT create or update permissions can craft a tag name containing arbitrary HTML and JavaScript. When any user with access to the Kanban view encounters a ticket, problem, change, or project labeled with the malicious tag, the injected script executes in their browser context with their privileges. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Business impact

This vulnerability poses a moderate but meaningful risk to GLPI deployments. An insider threat or compromised account with tag management rights can launch phishing attacks, steal session cookies, capture credentials, or perform unauthorized actions against other GLPI users. Kanban views are commonly used across ticket and project workflows, making exposure broad. The requirement for prior authentication and specific role-based permissions limits blast radius compared to unauthenticated XSS, but organizations relying on GLPI for critical incident or change management should treat this seriously. Affected users include anyone viewing Kanban boards containing the malicious tag, potentially spanning teams and departments.

Affected systems

GLPI installations running the Tag plugin version 11 before 2.14.4 are affected. GLPI is an open-source IT Asset Management and Help Desk system commonly deployed in medium to large organizations. The vulnerability applies to any GLPI version 11 deployment using an unpatched Tag plugin. Verify your installed Tag plugin version by checking the GLPI administration panel or plugin directory.

Exploitability

Exploitability is moderately constrained by three factors: (1) the attacker must be authenticated to GLPI, (2) the attacker must hold TAG MANAGEMENT create or update permissions, and (3) the victim must view a Kanban board containing the tag. However, within these constraints, exploitation is trivial—tag creation or modification interfaces typically accept free-form text input, and injecting basic HTML payloads requires no technical sophistication. Once created, the malicious tag persists and affects every user who opens affected Kanban views, making it a high-impact attack relative to effort. The vulnerability is not listed on the CISA KEV catalog, suggesting it has not yet been observed in active exploitation campaigns, but this does not guarantee immunity.

Remediation

Organizations should prioritize upgrading the Tag plugin to version 2.14.4 or later. This version implements input sanitization and output escaping to prevent HTML injection. Before patching, audit existing tags in your GLPI instance for suspicious names or characters. Remove or rename any tags that may have been created with malicious intent. Restrict TAG MANAGEMENT permissions to trusted administrators and implement role-based access controls to minimize the surface area for insider attacks. Consider temporarily disabling Kanban views if tag names cannot be audited before patching.

Patch guidance

Update the GLPI Tag plugin to version 2.14.4 or any later version. Consult the official GLPI plugin repository or your vendor's advisory for download links and installation instructions. Verify the plugin version after upgrade by navigating to Administration > Plugins > Tag plugin details. Test the upgrade in a non-production environment first to ensure compatibility with your GLPI version and other active plugins. No configuration changes are required post-upgrade; the security fix is automatic.

Detection guidance

Search GLPI tag names for HTML special characters and suspicious keywords. Use database queries to audit the tags table for entries containing '<', '>', 'script', 'onerror', 'onload', or similar patterns. Monitor GLPI audit logs for tag creation or modification events, especially by privileged accounts outside normal working hours or from unusual IP addresses. Review access logs for Kanban view requests and correlate with user complaints of unexpected behavior. Web application firewalls or GLPI intrusion detection plugins may flag stored XSS patterns if configured, though signature-based detection of tag payloads is less reliable than direct inspection.

Why prioritize this

Although rated MEDIUM severity (CVSS 6.4), this vulnerability warrants near-term patching because it affects a widely-used GLPI feature (Kanban views), has low exploitation barriers within the authenticated perimeter, and persists across multiple users. The requirement for authentication and specific permissions prevents this from being critical, but the high impact on confidentiality and integrity within the affected scope justifies prioritization. Organizations should schedule patching within 30–60 days unless tag management is restricted to a very small trusted group, in which case risk is lower but not eliminated.

Risk score, explained

The CVSS 3.1 score of 6.4 (MEDIUM) reflects a stored XSS vulnerability with restricted attack surface. Network-based attack vector (AV:N) acknowledges that GLPI is typically accessible over the network. High complexity (AC:H) and high privileges (PR:H) account for the need to authenticate and hold tag management rights. User interaction (UI:R) is required because the victim must open a Kanban view. Scope is unchanged (S:U), as impact is limited to the GLPI application and its users. Confidentiality, integrity, and availability are all rated high (C:H/I:H/A:H) because stored XSS can steal data, modify displayed information, or trigger client-side denial-of-service. The score appropriately reflects meaningful but not critical risk.

Frequently asked questions