CVE-2019-25264
Persistent XSS via Malicious SVG Upload in Snipe-IT
Publication date: 2026-02-03
Last updated on: 2026-02-03
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| snipe-it | snipe-it | to 4.7.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2019-25264 is a persistent cross-site scripting (XSS) vulnerability in Snipe-IT version 4.7.5 and earlier. It allows authorized users to upload malicious SVG files that contain embedded JavaScript code. When other users view these SVG files within the application, the embedded scripts execute arbitrary JavaScript in their browsers.
This happens because the application does not properly sanitize or neutralize the script tags inside the uploaded SVG files, enabling attackers to inject and persistently store malicious scripts on the server.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "This vulnerability can lead to attackers executing arbitrary JavaScript code in the context of other users' browsers when they view the malicious SVG files. Potential impacts include session hijacking, unauthorized actions within the application, and data compromise."}, {'type': 'list_item', 'content': "Execution of arbitrary JavaScript code in victim users' browsers."}, {'type': 'list_item', 'content': 'Hijacking of user sessions.'}, {'type': 'list_item', 'content': 'Unauthorized actions performed on behalf of other users.'}, {'type': 'list_item', 'content': 'Potential compromise of user data.'}] [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by checking for the presence of malicious SVG files containing embedded JavaScript uploaded by authorized users in the accessories section of the Snipe-IT application.'}, {'type': 'paragraph', 'content': 'One way to detect exploitation attempts is to monitor POST requests to the /accessories endpoint with multipart/form-data payloads that include SVG files.'}, {'type': 'paragraph', 'content': 'A practical approach is to inspect uploaded SVG files for embedded <script> tags or JavaScript code.'}, {'type': 'list_item', 'content': 'Use a command-line tool like curl or wget to capture or replay POST requests to /accessories and analyze the uploaded files.'}, {'type': 'list_item', 'content': 'Example command to check for suspicious SVG files on the server filesystem (assuming access):'}, {'type': 'list_item', 'content': "grep -r --include='*.svg' '<script' /path/to/snipe-it/uploads/"}, {'type': 'list_item', 'content': 'Use web application logs to identify POST requests to /accessories that include SVG uploads.'}] [3]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Snipe-IT to version 4.7.5 or later, where this vulnerability has been addressed.
After upgrading, clear browser cookies to avoid session issues.
Additionally, restrict the ability to upload SVG files to trusted users only or disable SVG uploads if possible.
Implement input validation or sanitization on uploaded SVG files to remove embedded JavaScript.
Monitor and audit uploaded accessories for suspicious SVG files containing script tags.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
[{'type': 'paragraph', 'content': "The vulnerability allows authorized users to upload malicious SVG files containing embedded JavaScript, which can execute arbitrary code in other users' browsers. This can lead to session hijacking or unauthorized actions within the application."}, {'type': 'paragraph', 'content': 'Such security weaknesses may impact compliance with standards and regulations like GDPR or HIPAA, which require protection of user data and prevention of unauthorized access or data breaches.'}, {'type': 'paragraph', 'content': 'However, the provided information does not explicitly discuss the direct effects of this vulnerability on compliance with these standards.'}] [1, 3]