EUVD-2026-42996
GHSA-jhph-5q74-pmfx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L for authenticated low-privilege upload; UI:R for victim opening attachment; S:C and limited C/I reflect same-origin session JavaScript access.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline(), allowing a low-privilege user to upload active XHTML or XML content that is later served same-origin and executes JavaScript in a viewer’s browser. This issue is fixed in version 8.6.2.
AnalysisAI
Stored cross-site scripting in Snipe-IT prior to 8.6.2 enables a low-privilege authenticated user to upload malicious XHTML or XML files that bypass the SVG sanitization gate and execute arbitrary JavaScript in any viewer's browser when the attachment is opened inline. The bypass works because UploadFileRequest only sanitizes SVG content when PHP's finfo extension reports image/svg+xml - uploading XHTML or generic XML evades this check - while UploadedFilesController serves the file same-origin without invoking StorageHelper::allowSafeInline(), completing the injection path. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor released a confirmed fix in version 8.6.2.
Technical ContextAI
Snipe-IT is a PHP-based open-source IT asset and license management platform. The vulnerability spans two components: UploadFileRequest (the upload validator) and UploadedFilesController (the attachment-serving controller). Sanitization in UploadFileRequest is gated on PHP's finfo extension detecting the MIME type image/svg+xml; XHTML and XML files carrying embedded script elements report different MIME types and pass through unsanitized. UploadedFilesController then serves these files as inline attachments without calling StorageHelper::allowSafeInline(), meaning the browser receives the content with its original MIME type and renders it in-page, executing any embedded JavaScript in the application's same-origin context. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class: user-supplied active content is not neutralized before it reaches a victim's rendering context. The fix is implemented in commit 000cea0a622d586366cf60d2240c7c2a4b17c955 and shipped as release v8.6.2.
RemediationAI
Upgrade Snipe-IT to version 8.6.2 or later, the vendor-confirmed fix released via commit 000cea0a622d586366cf60d2240c7c2a4b17c955 (https://github.com/grokability/snipe-it/commit/000cea0a622d586366cf60d2240c7c2a4b17c955) and documented in the security advisory GHSA-jhph-5q74-pmfx. As a compensating control prior to patching, restrict file upload permissions to the smallest set of trusted roles - eliminating the low-privilege upload vector removes the attacker's entry point entirely; the trade-off is reduced self-service capability for end users. A second compensating measure is to configure the web server or reverse proxy to force Content-Disposition: attachment on all files served from the uploads path, preventing inline rendering; note this will break any existing inline preview functionality for PDFs and images. Deploying a strict Content-Security-Policy header that blocks inline scripts on the Snipe-IT origin can also limit same-origin JavaScript execution as a defense-in-depth measure, though CSP misconfiguration can introduce false assurance. Patch deployment is the only complete remediation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today