CVE-2026-5385 is a CWE-79 cross-site scripting vulnerability in the glpi project. It permits an unauthenticated user who has write access to the knowledge base to inject and store XSS payloads within knowledge base items. This occurs due to improper input sanitization during web page generation. The vulnerability affects glpi versions prior to 11.0.7. The CVSS 4.0 base score is 8.4, indicating high severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. The vulnerability impacts confidentiality, integrity, and availability with high severity. No vendor advisory or patch information is currently available.

An attacker with write access to the knowledge base can inject malicious scripts that may execute in the context of other users viewing the affected knowledge base items. This can lead to theft of session tokens, defacement, or other malicious actions impacting confidentiality, integrity, and availability. The vulnerability requires the attacker to be unauthenticated but have write permissions to the knowledge base, and user interaction is needed for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict write access to the knowledge base to trusted users only and consider additional input validation or sanitization controls if possible.