Stored XSS in Snipe-IT via SVG Upload

Executive Summary

CVE-2026-55466 is a stored cross-site scripting (XSS) vulnerability in the Snipe-IT asset management system affecting versions 8.6.1 and earlier.

The vulnerability arises because the system sanitizes SVG uploads only when the MIME type is detected as image/svg+xml by PHP's finfo, but it allows uploading XML files (such as XHTML) without proper sanitization.

A low-privilege user can upload a malicious XHTML or XML file containing embedded JavaScript. When this file is served inline by the application without proper safety checks, the browser executes the embedded script, leading to XSS.

The root cause is that the inline serving path does not enforce the StorageHelper::allowSafeInline() whitelist, allowing unsafe inline rendering of uploaded files.

This issue was fixed in version 8.6.2 by adding proper checks before serving files inline.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your Snipe-IT installation allows uploading XML or XHTML files that are served inline without proper sanitization or validation.

One way to detect it is to attempt uploading an XML or XHTML file containing JavaScript payloads and then accessing the file via the inline=true parameter to see if the script executes in the browser.

You can also inspect the server code or configuration to verify if the StorageHelper::allowSafeInline() check is implemented when serving files inline.

No specific commands are provided in the resources, but general detection steps include:

• Attempt uploading a .xml or .xhtml file with embedded JavaScript payload.
• Access the uploaded file via the inline=true parameter in the download URL.
• Observe if the JavaScript executes in the browser, indicating the vulnerability.
• Check the Snipe-IT version; versions prior to 8.6.2 are vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with low privileges to execute arbitrary JavaScript in the browsers of users who view the malicious uploaded file.

• Execution of malicious scripts can lead to theft of cookies or session tokens.
• It can result in unauthorized actions performed on behalf of the victim user.
• It may lead to compromise of user accounts or sensitive information accessible through the browser session.
• Overall, it undermines the security and trustworthiness of the application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a low-privilege user to upload malicious XHTML or XML content that executes JavaScript in a viewer's browser, potentially leading to unauthorized access to sensitive information such as cookies.

Such unauthorized script execution can result in data breaches or exposure of personal or sensitive data, which may violate data protection regulations like GDPR or HIPAA that require safeguarding personal and sensitive information.

Therefore, the presence of this vulnerability could negatively impact compliance with these standards by enabling cross-site scripting attacks that compromise data confidentiality and integrity.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Snipe-IT to version 8.6.2 or later, where this vulnerability is fixed.

If upgrading immediately is not possible, restrict or disable the ability for low-privilege users to upload XML or XHTML files.

Additionally, review and apply the patch that introduces the StorageHelper::allowSafeInline() check before serving files inline, ensuring unsafe files are not rendered inline.

Consider monitoring and blocking suspicious file uploads and inline file serving until the patch or upgrade is applied.

Useful 0 Not Useful 0