CVE-2026-63498
Received Received - Intake

XSLT to JavaScript Execution in Snipe-IT

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The app/Http/Controllers/Api/UploadedFilesController.php show() path does not apply the safe-inline allowlist used by the equivalent web controller, so the browser can process an attacker-controlled xml-stylesheet reference and execute JavaScript generated by the stylesheet in the Snipe-IT origin. A victim who is authorized to view the object must open the attachment URL, after which the script can read same-origin data and perform authenticated actions with the victim's privileges. This issue is fixed in version 8.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-63498
EUVD
EUVD-2026-86288

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
snipeit snipeit 8.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Snipe-IT allows an authenticated user with file-management access to upload XML and XSLT files. When these files are accessed with the inline=true parameter, the application fails to enforce a safe-inline policy, allowing the browser to process attacker-controlled XML stylesheets. This can lead to JavaScript execution within the Snipe-IT origin, enabling the attacker to read same-origin data and perform actions on behalf of the victim.

Detection Guidance

Check Snipe-IT version for files below 8.7.0. Inspect API responses for GET /api/v1/{object_type}/{id}/files/{file_id} with inline=true parameter. Review uploaded files for XML/XSLT attachments and verify if browser processes them with JavaScript execution.

Impact Analysis

If you are an authorized user of Snipe-IT, an attacker could trick you into opening a malicious attachment URL. This could allow the attacker to steal sensitive data, such as asset or license information, or perform actions on your behalf, such as modifying or deleting records.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Unauthorized data exposure or modification may result in compliance breaches, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade Snipe-IT to version 8.7.0 or later immediately. Remove or restrict file-upload permissions for users without a valid need. Monitor network traffic for suspicious API calls to the affected endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63498. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart