CVE-2026-40108 is a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability in the GLPI asset and IT management software. Specifically, in versions 11.0.0 up to but not including 11.0.7, a technician user can inject and store an XSS payload within ITIL cost fields. This vulnerability was addressed and fixed in GLPI version 11.0.7. The CVSS 4.0 base score is 7.1, indicating a high severity issue with network attack vector, high complexity, and requiring authenticated technician privileges with user interaction.

Successful exploitation allows a technician to inject malicious scripts into the application via ITIL cost input fields, which could lead to execution of arbitrary scripts in the context of other users viewing the affected pages. This may result in session hijacking, unauthorized actions, or data exposure within the GLPI environment. The vulnerability requires authenticated technician privileges and user interaction, limiting the attack scope somewhat.

Upgrade GLPI to version 11.0.7 or later, where this XSS vulnerability has been fixed. Since the vendor advisory indicates the issue is resolved in 11.0.7, applying this official fix is the recommended remediation. No other mitigation guidance is provided or necessary.