The vulnerability allows a technician to inject an arbitrary JavaScript payload into the asset lock field, which is then stored permanently in the database. When the asset page is viewed, the script executes in the context of any logged‑in user, potentially allowing theft of session cookies, defacement of the web interface, or redirection to malicious sites. This flaw is a classic stored XSS reflected in the CWE‑79 taxonomy and also involves improper handling of character data (CWE‑116).

GLPI versions starting at 10.0.4 and up to, but not including, 10.0.25 – that is, 10.0.4 through 10.0.24 – are vulnerable. Similarly, all releases of the 11.0 series preceding 11.0.7 (i.e., 11.0.0 through 11.0.6) also remain susceptible. Any deployment running these legacy releases requires an upgrade to 10.0.25 or 11.0.7 to fix the stored XSS flaw.

With a CVSS score of 8.4 the flaw is considered high severity. No EPSS information is available, and the flaw is not listed in the CISA KEV catalog, but the stored nature of the payload provides a realistic attack vector via the web application. An attacker with technician privileges can enter the payload, and any subsequent user viewing the affected asset will be exposed. The lack of built‑in input validation or sanitization in the asset lock interface is the root cause of this risk.