---
id: "CVE-2026-115982"
kind: "vulnerability"
aliases: ["CVE-2026-115982"]
title: "phpIPAM: rack link deviceid parameter allows cross-site scripting"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "phpipam", "self-hosted"]
not_affected_if: ["newer-version", "rack-feature-unused"]
published_at: "2026-10-24T22:16:27+00:00"
first_seen_at: "2026-10-24T22:46:00+00:00"
updated_at: "2026-10-25T04:29:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115982", "first_seen_at": "2026-10-24T22:46:00+00:00"}]
---

# phpIPAM: rack link deviceid parameter allows cross-site scripting

phpIPAM up to 1.8.3 does not sanitize the deviceid argument in the Rack Link Creation function of app/tools/racks/show-rack-popup.php. An attacker can inject script that runs in the browser of a user who opens the crafted link or page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed phpIPAM version against `1.8.3`.
- Look for `app/tools/racks/show-rack-popup.php` in the installation and check whether it passes `deviceid` into output without escaping.

## Fix

- Upgrade phpIPAM to a release newer than `1.8.3` once the vendor ships a fix (unknown if one is available yet).
- Until then, restrict access to the phpIPAM web interface to trusted networks.

## Timeline

- 2026-10-24T22:46:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115982

## From the sources

A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_