Executive brief
Snipe-IT is an asset management platform used to track and manage IT equipment and inventory. A flaw in its file upload and serving logic allows users with basic asset-viewing permissions to upload malicious XML files containing executable scripts. When these files are served back through the application, the browser executes the scripts with full access to user cookies and sessions, enabling attackers to steal admin credentials or impersonate other users. An attacker needs only low-level account access to exploit this vulnerability.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in Snipe-IT's file upload and serving mechanism. The root cause is a logic gap in upload validation: the UploadFileRequest sanitizer only triggers for files detected as image/svg+xml by PHP's finfo utility, but allows XML and other document types through without sanitization. An attacker creates an XHTML file (which PHP's finfo identifies as text/xml rather than image/svg+xml), bypassing the SVG sanitization step. The file is stored raw with any embedded <script> tags intact. When served inline via the UploadedFilesController with Content-Disposition: inline, the browser treats it as an executable XHTML document and runs the JavaScript in the same origin. The existing StorageHelper::allowSafeInline() whitelist exists but is never invoked in the serve path. An attacker requires only assets.view and assets.files permissions (low-privilege) and the target user must visit the malicious file URL with inline=true parameter. Patch version 8.6.2 fixes this by implementing proper content-type validation and sanitization.
Affected products
- grokability snipe-it <= 8.6.1
Timeline
- 2026-06-24: disclosed
- 2026-08-28: advisory
- 2026: patched: Version 8.6.2 released