CVE-2026-30865

Executive Summary

CVE-2026-30865 is a Reflected Cross-Site Scripting (XSS) vulnerability in Combodo iTop, a web-based IT Service Management (ITSM) platform, affecting versions prior to 3.2.3. The flaw resides in the dashboard save functionality, where an attacker can inject malicious JavaScript that executes within a victim's browser session. With a CVSS score of 7.1, successful exploitation allows an attacker to execute arbitrary scripts in the context of the logged-in user, potentially leading to session hijacking, administrative account compromise, and unauthorized data access within the ITSM environment.

Technical Analysis

Combodo iTop is a widely deployed open-source IT service management solution used for managing IT assets, incidents, and change requests across enterprise environments. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Reflected Cross-Site Scripting flaw.

The affected component is the dashboard save functionality. Dashboard configurations in iTop allow administrators to customize their view of the ITSM system — these customizations are saved server-side. The vulnerability arises when user-supplied input, likely in the form of dashboard parameter names, configuration identifiers, or saved dashboard title/name values, is reflected back in the HTTP response without proper sanitization or output encoding. Because the input is echoed back to the browser (reflected), the attacker can craft a malicious URL containing the payload. When a victim clicks the link, the injected script executes in their active session.

The attack vector is network-based (AV:N) with low attack complexity (AC:L), meaning no special conditions are required for exploitation. No authentication or access privileges are needed on the part of the attacker to craft the attack (PR:N), though user interaction is required (UI:R) — the victim must click the crafted link. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component. The potential impact spans confidentiality (C:L), integrity (I:L), and availability (A:L), each at low severity.

The NVD description does not provide specific technical implementation details such as exact parameter names, URL endpoints, or code-level function references. Therefore, the precise injection point within the dashboard save code path remains undisclosed. What can be inferred is that the flaw follows the standard reflected XSS pattern: unsanitized input is accepted, stored or immediately processed by the dashboard save routine, and subsequently rendered in the response to the user.

insufficient technical detail available for exact parameter naming.

Exploitation Scenarios

The attack chain for this vulnerability is inferred from its classification as a reflected XSS and the CVSS vector; no public PoC is available. The following is a class-level description:

Step 1 — Target Identification: An attacker identifies organizations using Combodo iTop by scanning for exposed instances. This can be done via web crawling, search engine dorking (e.g., finding login portals), or using service fingerprinting tools such as Shodan or Nuclei. The attacker looks for iTop instances that have not been upgraded to version 3.2.3.

Step 2 — Crafting the Malicious Link: The attacker constructs a crafted URL that targets the dashboard save functionality. The URL contains a malicious payload in a query parameter or form field that the application reflects back into the page. Because this is a reflected XSS, the payload does not need to be stored on the server — it is embedded directly in the URL. The payload is typically JavaScript code designed to execute in the victim's browser context, such as:

• Stealing session cookies via document.cookie.
• Capturing keylogging data.
• Performing authenticated actions on behalf of the victim (CSRF-style attacks by hijacking the session).

Step 3 — Delivery and Execution: The attacker delivers the crafted link via phishing email, instant messaging, or by inserting it into a public forum or an internal wiki page that iTop administrators might visit. Upon clicking the link, the victim's browser issues an HTTP request to the iTop server. The server processes the request through the dashboard save routine, reflects the unsanitized parameter back into the HTTP response, and the browser executes the injected JavaScript.

Step 4 — Post-Exploitation Impact: The injected script executes with the victim's privileges and session context. If the victim is an administrator, the attacker can fully compromise the ITSM instance — modifying dashboards, viewing tickets containing sensitive data (e.g., passwords, hardware inventory, incident details), creating backdoor accounts, or exfiltrating configuration data. If the victim is a lower-privileged user, the attacker can access data within that user's visibility scope and potentially perform lateral movement by escalating privileges via session token theft.

It is important to note: no public PoC exists; attack chain is inferred from vulnerability class. The described payload mechanisms (cookie theft, keylogging) are general XSS techniques, not specific implementations verified against CVE-2026-30865.

Impact Assessment

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates a medium-severity vulnerability with network exploitability requiring no privileges but necessitating user interaction. The most significant business risk is the unauthorized access to sensitive ITSM data. iTop instances routinely store corporate asset inventories, helpdesk ticket content (often containing credentials and internal network information), change management records, and service configuration details. A successful XSS attack that compromises an administrative session could result in:

• Confidentiality breach: Theft of tickets, asset data, and configuration secrets.
• Integrity compromise: Unauthorized changes to dashboards, tickets, or system configurations.
• Availability impact: Potential to lock out users by altering authentication settings or damaging dashboard functionality.

The scope changed (S:C) element of the CVSS signifies that the compromised component (the browser session) is separate from the vulnerable application, meaning the injected script can interact with other resources in the victim's browser context. This could include other tabs or applications on the same origin/domain, expanding the blast radius.

The most critical affected users are iTop administrators who have elevated permissions and access to configuration management data. However, all authenticated iTop users are potentially impacted when they interact with malicious links.

Because the vulnerability is not yet listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and no exploit code is publicly available, the immediate in-the-wild exploitation risk is currently low. However, given the wide deployment of iTop in MSP environments and large enterprises, the potential for weaponization is significant once detailed technical information becomes available.

Detection Guidance

Sigma Rule

title: CVE-2026-30865 - Reflected XSS in Combodo iTop Dashboard Save
id: 4f6c9b3e-2c8a-4c5d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects potential exploitation attempts targeting the Combodo iTop reflected XSS vulnerability in the dashboard save functionality (CVE-2026-30865).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-30865
author: Valtersit Security Research
date: 2026/06/01
logsource:
    category: webserver
    product: apache
    definition: 'iTop instances must be running behind a web server that logs URI query strings'
detection:
    selection:
        cs-method: GET
        c-uri|contains:
            - 'ajax.dashboard.php'
            - 'pages/UI.php'
            - 'dashboard'
    filter_known_good:
        c-uri|contains:
            - 'static'
            - 'images'
            - 'css'
    condition: selection and not filter_known_good
level: high
falsepositives:
    - Legitimate dashboard configuration requests that include dashboard names containing special characters
    - URL parameters that are subsequently encoded by the application
fields:
    - c-uri
    - cs-method
    - c-useragent
tags:
    - attack.t1190
    - cve.2026-30865
    - cwe.79

YARA Rule

rule CVE_2026_30865_Combodo_iTop_Reflected_XSS {
    meta:
        author = "Valtersit Security Research"
        description = "Detects Compressed attack payloads targeting the Combodo iTop reflected XSS in dashboard save functionality"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-30865"
        cve = "CVE-2026-30865"
        date = "2026-06-01"
        score = 60
    strings:
        $dashboard_param = "dashboard=" ascii nocase
        $config_param = "cfg=" ascii nocase
        $xss_payloads = /onerror\s*=|javascript\s*:|<script[^>]*>[^<]{10,}/ ascii
        $encoding = /%3Cscript|%3cscript|&lt;script|\\x3c\\x73\\x63\\x72\\x69\\x70\\x74/ ascii
    condition:
        uint16(0) == 0x4D5A or uint32(0) == 0x504B0304
        and 1 of ($xss_payloads) and ($dashboard_param or $config_param)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-30865 - Combodo iTop Reflected XSS in Dashboard Save";
    flow:established,to_server;
    http.uri;
    content:"dashboard"; http_uri; nocase;
    pcre:"/(<script|javascript:|onerror=|onload=)/Ui";
    classtype:web-application-attack;
    sid:202630865;
    rev:1;
    reference:cve,2026-30865;
    metadata:created_at 2026_06_01, updated_at 2026_06_01;
)

Elastic Detection

/* Detection for CVE-2026-30865 - Reflected XSS in Combodo iTop dashboard save */
sequence by source.ip with maxspan=5m
  [ network where event.type == "connection" and destination.port == 443 and
    network.protocol == "http" ]
  [ http where event.category == "web" and
    http.request.method == "GET" and
    url.path contains "dashboard" and
    (url.query contains "javascript:" or
     url.query contains "<script" or
     url.query contains "onerror=" or
     url.query contains "%3Cscript")
  ]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="*/dashboard*" OR uri_path="*ajax.dashboard*"
| regex uri_query="(?i)(<script|javascript:|onerror=|onload=)"
| eval attack_type="CVE-2026-30865 Reflected XSS attempt"
| eval severity="high"
| table _time, src_ip, dest_ip, uri, uri_query, http_user_agent, method
| sort _time desc

Wazuh OSSEC Rule

<group name="web, webserver, xss,">
  <rule id="100308" level="10">
    <decoded_as>web</decoded_as>
    <match>dashboard</match>
    <regex>(\&lt;script|javascript:|onerror=|onload=)</regex>
    <description>CVE-2026-30865 - Reflected XSS attempt detected in Combodo iTop (dashboard save)</description>
    <group>cve-2026-30865,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2026-30865</info>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. The vulnerability has been fixed in Combodo iTop version 3.2.3, and upgrading to this version is the definitive remediation.

Immediate Mitigations (until patching is possible):

1. Apply input validation controls at the web server layer: Configure a WAF (Web Application Firewall) with rules that block requests containing common XSS payload signatures (e.g., <script>, javascript:, onerror=, onload=) in URI query strings targeting dashboard endpoints.
2. Disable or restrict access to the dashboard save functionality: If possible, restrict access to dashboard configuration features to only authorized administrators using strict network access controls (e.g., IP whitelisting, VPN requirements).
3. Implement browser-side protections: Advise users to disable JavaScript for the iTop domain or use browser extensions that block script execution for untrusted pages.
4. Educate users: Train iTop administrators and users to not click unsolicited links, especially those containing unusual characters or parameterized URLs.

Patch/Upgrade Steps:

1. Upgrade iTop to version 3.2.3 or later: Obtain the latest version from the official Combodo distribution channel (https://www.combodo.com/download).
2. Back up the existing instance: Before upgrading, perform a full backup of the database and configuration files.
3. Follow vendor upgrade instructions: Use the documented upgrade procedure, maintaining any custom modules or extensions.
4. Validate the upgrade: After deployment, verify the version number and run functional tests on the dashboard save functionality.

Long-Term Hardening:

1. Establish a patch management lifecycle: Enroll iTop in your organization's vulnerability management program to ensure rapid deployment of future security updates.
2. Enable output encoding: Ensure that the application's development framework applies output encoding for all user-generated data. For iTop customizations, follow OWASP XSS prevention cheat sheet practices.
3. Implement Content Security Policy (CSP): Configure a strict CSP header on the web server to block execution of inline scripts and untrusted sources, mitigating XSS impact even if the vulnerability recurs.
4. Monitor for attempted exploitation: Deploy the detection rules provided above in your SIEM and IDS to identify and alert on exploitation attempts.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-30865 (official CVE description and CVSS data)
2. Vendor Advisory: Not publicly available at the time of this report's writing. Users should monitor Combodo's official site (https://www.combodo.com) for the advisory corresponding to version 3.2.3.
3. OWASP XSS Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html (industry best practices for preventing XSS class vulnerabilities).
4. CISA Known Exploited Vulnerabilities Catalog: CVE-2026-30865 is NOT listed on the KEV catalog as of this report’s date, indicating no confirmed in-the-wild exploitation has been reported to CISA.

At the time of publication, no threat actor campaigns or exploit-in-the-wild evidence has been observed for CVE-2026-30865. The absence of public PoC code and an EPSS score (not yet scored by FIRST.org) suggests limited active exploitation; however, the vulnerability’s low attack complexity means weaponization is feasible once reverse-engineered from the patch.