GLPI versions >= 10.0.4 and < 10.0.25 contain an improper neutralization of input during web page generation (CWE-79), allowing a technician to inject and store malicious scripts in the asset locked tab. This cross-site scripting vulnerability can lead to high impact on confidentiality, integrity, and availability as indicated by the CVSS 4.0 score of 8.4. The vulnerability is fixed in versions 10.0.25 and 11.0.7.

Successful exploitation allows a technician-level user to inject malicious scripts that execute in the context of other users viewing the affected asset locked tab. This can lead to compromise of user sessions, data theft, or other malicious actions impacting confidentiality, integrity, and availability of the system. The CVSS 4.0 score of 8.4 reflects a high severity with network attack vector, low attack complexity, no privileges required beyond technician, and user interaction needed.

Upgrade affected GLPI installations to version 10.0.25 or 11.0.7 where the vulnerability is patched. No other official remediation or temporary fixes are documented. Patch status is confirmed by the vendor's version guidance in the advisory.