---
id: CVE-2025-59935
title: GLPI is a free asset and IT management software package
summary: >-
  GLPI is a free asset and IT management software package. Starting in version
  10.0.0 and prior to version 10.0.21, an unauthenticated user can store an XSS
  payload through the inventory endpoint. Users should upgrade to 10.0.21 to
  receive…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'
cwe:
  - CWE-79
vendor: glpi-project
product: glpi
affected:
  - 'glpi >= 10.0.0, < 10.0.21'
patched:
  - glpi 10.0.21
published: '2025-12-16'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T11:10:00.203'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59935'
references:
  - url: >-
      https://github.com/glpi-project/glpi/security/advisories/GHSA-j8vv-9f8m-r7jx
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00288
epssPercentile: 0.19698
ingestedAt: '2026-10-13T11:23:51.110Z'
---

## Overview

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.21, an unauthenticated user can store an XSS payload through the inventory endpoint. Users should upgrade to 10.0.21 to receive a patch.

## Affected

- `glpi >= 10.0.0, < 10.0.21`

## Remediation

Upgrade past the affected range:

- `glpi 10.0.21`