This vulnerability (CVE-2026-5385) in glpi-project's glpi product involves improper neutralization of input during web page generation (CWE-79). Specifically, an unauthenticated user who has write access to the knowledge base can inject and store a cross-site scripting payload within a knowledge base item. The affected versions are all releases prior to 11.0.7. The CVSS 4.0 base score is 8.4, indicating high severity, with network attack vector, low attack complexity, no privileges required, and user interaction needed. The vulnerability impacts confidentiality, integrity, and availability with high scope and impact metrics. No vendor advisory or patch information is currently available.

Successful exploitation allows an unauthenticated attacker with write access to the knowledge base to inject malicious scripts that execute in the context of other users viewing the knowledge base items. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed with the privileges of the victim user. The vulnerability affects confidentiality, integrity, and availability with high impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write access to the knowledge base to trusted users only and consider additional input validation or filtering on knowledge base content to mitigate risk.