Description
The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via PluginTagTag::preKanbanContent() without output escaping, resulting in stored cross-site scripting. An authenticated user with TAG MANAGEMENT create or update rights can set a tag name containing HTML, which then executes in the browser of any user who opens the Kanban view of a ticket, problem, change, or project the tag is attached to.
CVSS 6.4EPSS 0.34099999999999997%Risk 0.66
View source- Published
- 2026-07-09 17:17:01
- Affected versions
- <2.14.4
- Type
- Web application
- Last modified
- 2026-07-20 18:16:53
- Vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H