GLPI asset and IT management software contains a stored XSS flaw in ITIL cost records, allowing a malicious script to be stored and later executed when the record is viewed. The vulnerability can enable an attacker to run arbitrary code in the context of logged‑in users, potentially compromising session cookies, sensitive data, or executing actions on behalf of the victim. The weakness is classified as CWE‑79.

The flaw is present in GLPI versions 11.0.0 through 11.0.6. Management of ITIL costs is performed by users with technician privileges, so any installed instance running one of those versions is susceptible.

The CVSS score of 7.1 indicates a high severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires the attacker to have access to a technician role within GLPI; they can inject the payload into the cost field which is then rendered unescaped when viewed by other users. If an attacker gains such access, the stored script would execute in the browsers of any user who opens the affected ITIL cost record.