Snipe-IT EUVD-2026-42996

The attacker must hold a valid Snipe-IT account with file upload permissions - the CVSS PR:L metric confirms authentication at the low-privilege level is required; unauthenticated exploitation is not possible. The target instance must be running a version prior to 8.6.2. A second prerequisite is victim interaction (UI:A): a separate user, typically an administrator, must actively open the malicious attachment inline in their browser - the exploit does not trigger on upload alone. The MIME-type bypass is specifically conditional on the uploaded file being XHTML or XML rather than SVG, since PHP's finfo reports a non-SVG type and skips sanitization. No non-default Snipe-IT configuration setting is required; any deployment that permits low-privilege file uploads - the default posture for many installations - is vulnerable. Exploitation is bounded by the need for both an attacker-controlled account and an identifiable victim who will open the attachment.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/SC:H/SI:H/SA:N) scores 6.2, placing this in the medium band. The SC:H/SI:H metrics are the critical signal: successful exploitation yields same-origin JavaScript execution within the victim's active session, enabling session-token theft, CSRF-driven privileged actions, or exfiltration of asset data visible to the victim - impacts typical of stored XSS against an administrative user. The constraining factors are PR:L (attacker must hold a valid account with upload permissions) and UI:A (a second user must actively open the attachment inline). These prerequisites meaningfully reduce opportunistic mass exploitation risk. No CISA KEV listing exists and no EPSS data was provided in the source intelligence; combined, this indicates no observed widespread exploitation at time of analysis. Despite the modest score, the privilege-escalation dynamic - a low-privilege user targeting an administrator via a plausible workflow artifact - makes this a real operational risk in multi-user Snipe-IT deployments. The attack complexity is low once an account is obtained, and the finfo MIME-type bypass technique is well understood in the PHP security community.

An attacker with a low-privilege Snipe-IT account crafts an XHTML file embedding a JavaScript payload - such as a script that exfiltrates document.cookie to an attacker-controlled endpoint - and uploads it as an attachment to an asset record. When an administrator later opens the attachment inline through the Snipe-IT interface to review it, UploadedFilesController serves the XHTML same-origin without sanitization, the browser executes the embedded script in the administrator's session, and the attacker receives the stolen session token. No public proof-of-concept has been identified at time of analysis, though the finfo MIME-bypass technique requires no specialized tooling.