EUVD-2026-336144

fkie_cve-2026-55466

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline(), allowing a low-privilege user to upload active XHTML or XML content that is later served same-origin and executes JavaScript in a viewer’s browser. This issue is fixed in version 8.6.2.

GHSA-jhph-5q74-pmfx — Snipe-IT vulnerable to stored XSS via inline-served attachment

Affected: Packagist: snipe/snipe-it

### Impact A low-privilege user can store an active-content payload as an asset attachment and have it served inline, same-origin, with an active Content-Type, achieving stored XSS. The application sanitizes uploads only when PHP finfo detects image/svg+xml. By submitting an XHTML document whose finfo MIME is text/xml (an allowed extension), the svg-sanitize branch is skipped, the <script> is stored raw, and the inline-serve path returns it as text/xml; charset=utf-8 with Content-Disposition: inline — which the browser renders as a live XHTML document and executes. The dedicated StorageHelper::allowSafeInline() whitelist that should have constrained inline-renderable types is never wired into the serve path.

### Details Vulnerable code — sanitizer keyed on finfo MIME `app/Http/Requests/UploadFileRequest.php:46-53`

```php $extension = $file->getClientOriginalExtension(); $file_name = $name_prefix.'-'.str_random(8).'-'.str_slug(...).'.'.$file->guessExtension(); ... if ($file->getMimeType() === 'image/svg+xml') { $uploaded_file = $this->handleSVG($file); // svg-sanitize fires } else { $uploaded_file = file_get_contents($file); // stored RAW — no sanitization } ```

Vulnerable code — inline serve, no `allowSafeInline()` `app/Http/Controllers/UploadedFilesController.php:103`

```php if (request('inline') == 'true') { $headers = ['Content-Disposition' => 'inline']; return Storage::download($path.$log->filename, $log->filename, $headers); } ```

`StorageHelper…

WID-SEC-W-2026-2073 — Snipe-IT: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Snipe-IT ausnutzen, um Dateien zu manipulieren, um Sicherheitsvorkehrungen zu umgehen, um einen Cross-Site Scripting Angriff durchzuführen und um beliebigen Programmcode auszuführen.

Most recent entries from all

EUVD-2026-336144

fkie_cve-2026-55466

GHSA-jhph-5q74-pmfx — Snipe-IT vulnerable to stored XSS via inline-served attachment

WID-SEC-W-2026-2073 — Snipe-IT: Mehrere Schwachstellen