{"id":"CVE-2026-115982","kind":"vulnerability","aliases":["CVE-2026-115982"],"related":[],"title":"phpIPAM: rack link deviceid parameter allows cross-site scripting","description":"A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.","summary":"phpIPAM up to 1.8.3 does not sanitize the deviceid argument in the Rack Link Creation function of app/tools/racks/show-rack-popup.php. An attacker can inject script that runs in the browser of a user who opens the crafted link or page.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","phpipam","self-hosted"],"not_affected_if":["newer-version","rack-feature-unused"],"how_to_check":"- Check the installed phpIPAM version against `1.8.3`.\n- Look for `app/tools/racks/show-rack-popup.php` in the installation and check whether it passes `deviceid` into output without escaping.","fix":"- Upgrade phpIPAM to a release newer than `1.8.3` once the vendor ships a fix (unknown if one is available yet).\n- Until then, restrict access to the phpIPAM web interface to trusted networks.","status":"open","published_at":"2026-10-24T22:16:27+00:00","first_seen_at":"2026-10-24T22:46:00+00:00","triaged_at":"2026-10-25T04:29:19+00:00","updated_at":"2026-10-25T04:29:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:29:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade phpIPAM to a release newer than `1.8.3` once the vendor ships a fix (unknown if one is available yet).\n- Until then, restrict access to the phpIPAM web interface to trusted networks.","reach":"network","title":"phpIPAM: rack link deviceid parameter allows cross-site scripting","impact":"medium","summary":"phpIPAM up to 1.8.3 does not sanitize the deviceid argument in the Rack Link Creation function of app/tools/racks/show-rack-popup.php. An attacker can inject script that runs in the browser of a user who opens the crafted link or page.","category":"package","nicknames":[],"who_cares":["phpipam","self-hosted","php"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Script runs in a logged-in user's browser session","analyst_note":"Confirm whether authentication is required and whether a vendor fix exists; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115982.","how_to_check":"- Check the installed phpIPAM version against `1.8.3`.\n- Look for `app/tools/racks/show-rack-popup.php` in the installation and check whether it passes `deviceid` into output without escaping.","needs_analyst":true,"not_affected_if":["rack-feature-unused","newer-version"],"who_is_affected":"Any team running phpIPAM 1.8.3 or earlier with the rack feature in use is exposed. Installations that do not use the rack tools, or that are not reachable by untrusted users, carry less risk.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000629,"input_tokens":3345,"output_tokens":588,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115982':13A,16A '-2026':12A,15A '1.8.3':26B,69C 'affect':70C 'allow':6A 'app/tools/racks/show-rack-popup.php':40B,83C 'argument':32B,95C 'attack':42B,106C 'browser':50B 'compon':86C 'contact':121C 'craft':57B 'creat':77C 'creation':37B,89C 'cross':8A,99C 'cross-sit':7A 'cve':11A,14A 'detect':64C 'deviceid':4A,31B,96C 'disclosur':125C 'earli':122C 'exploit':103C,110C 'file':82C 'function':38B,76C 'host':22B 'inject':44B 'issu':73C 'link':3A,36B,58B,79C,88C 'manipul':92C 'may':115C 'open':55B 'packag':17B 'page':60B 'paramet':5A 'perform':90C 'php':18B 'phpipam':1A,19B,23B,66C 'possibl':108C 'public':113C 'rack':2A,35B,78C,87C 'remot':102C 'result':97C 'run':47B 'sanit':29B 'script':10A,45B,101C 'self':21B 'self-host':20B 'site':9A,100C 'use':117C 'user':53B 'vendor':119C 'vulner':62C","nicknames":[],"mitigations":[],"who_affected":"Any team running phpIPAM 1.8.3 or earlier with the rack feature in use is exposed. Installations that do not use the rack tools, or that are not reachable by untrusted users, carry less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T22:16:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115982","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115982","severity":null,"published_at":"2026-10-24T22:16:27+00:00","modified_at":"2026-10-24T22:16:27+00:00","first_seen_at":"2026-10-24T22:46:00+00:00","fetched_at":"2026-10-24T22:46:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}