# CVE-2026-55466: Grokability Snipe-IT stored XSS in asset attachments

Source: https://junglewise.ai/threats/cve-2026-55466-grokability-snipe-it-stored-xss-in-asset-attachments  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55466 · Severity: high · CVSS 8.7 · Published 2026-07-10

Snipe-IT is an asset management platform used to track and manage IT equipment and inventory. A flaw in its file upload and serving logic allows users with basic asset-viewing permissions to upload malicious XML files containing executable scripts. When these files are served back through the application, the browser executes the scripts with full access to user cookies and sessions, enabling attackers to steal admin credentials or impersonate other users. An attacker needs only low-level account access to exploit this vulnerability.

Technologies: [snipe/snipe-it (Packagist)](https://junglewise.ai/threats/technologies/snipe-snipe-it). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-55466 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55466 being exploited in the wild.

**How severe is CVE-2026-55466?** High severity, with a CVSS score of 8.7, published 10 July 2026.

**Which products and versions are affected?** snipe/snipe-it (Packagist) <= 8.6.1, ECOSYSTEM:introduced=0,fixed=8.6.2.

**Is there a fix for CVE-2026-55466?** Yes. snipe/snipe-it (Packagist): upgrade to 8.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55466 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55466?** Check whether you run snipe/snipe-it (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- snipe/snipe-it (Packagist): upgrade to 8.6.2 or later

  ```sh
  composer require snipe/snipe-it:^8.6.2
  ```


## Technical details

This is a stored cross-site scripting (XSS) vulnerability in Snipe-IT's file upload and serving mechanism. The root cause is a logic gap in upload validation: the UploadFileRequest sanitizer only triggers for files detected as image/svg+xml by PHP's finfo utility, but allows XML and other document types through without sanitization. An attacker creates an XHTML file (which PHP's finfo identifies as text/xml rather than image/svg+xml), bypassing the SVG sanitization step. The file is stored raw with any embedded <script> tags intact. When served inline via the UploadedFilesController with Content-Disposition: inline, the browser treats it as an executable XHTML document and runs the JavaScript in the same origin. The existing StorageHelper::allowSafeInline() whitelist exists but is never invoked in the serve path. An attacker requires only assets.view and assets.files permissions (low-privilege) and the target user must visit the malicious file URL with inline=true parameter. Patch version 8.6.2 fixes this by implementing proper content-type validation and sanitization.

## Affected products

- grokability snipe-it <= 8.6.1

## Identifiers

- CVE-2026-55466
- GHSA-jhph-5q74-pmfx

## Timeline

- 2026-06-24: disclosed
- 2026-08-28: advisory
- 2026: patched: Version 8.6.2 released

## References

- [https://api.github.com/users/callmeks](https://api.github.com/users/callmeks)
- [https://github.com/callmeks](https://github.com/callmeks)
- [https://api.github.com/users/callmeks/gists%7B/gist_id%7D](https://api.github.com/users/callmeks/gists%7B/gist_id%7D)
- [https://api.github.com/users/callmeks/repos](https://api.github.com/users/callmeks/repos)
- [https://avatars.githubusercontent.com/u/88197307?v=4](https://avatars.githubusercontent.com/u/88197307?v=4)
- [https://api.github.com/users/callmeks/events%7B/privacy%7D](https://api.github.com/users/callmeks/events%7B/privacy%7D)

## Related threats

- [Snipe-IT stored XSS via inline XML rendering in uploaded files API](https://junglewise.ai/threats/cve-2026-63498-snipe-it-stored-xss-via-inline-xml-rendering-in-uploaded-files)
- [Snipe-IT 2FA bypass via API token flow](https://junglewise.ai/threats/cve-2026-63493-snipe-it-2fa-bypass-via-api-token-flow)
- [Snipe-IT stored XSS in custom field names](https://junglewise.ai/threats/cve-2026-62368-snipe-it-stored-xss-in-custom-field-names)
- [Snipe-IT stored DOM XSS via table selected-count IDs](https://junglewise.ai/threats/cve-2026-61807-snipe-it-stored-dom-xss-via-table-selected-count-ids)
- [Snipe-IT maintenance record disclosure via missing authorization](https://junglewise.ai/threats/cve-2026-55703-snipe-it-maintenance-record-disclosure-via-missing-authorization)