CVE-2025-64027: XSS
Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, the application returns a progressmessage value that is rendered as raw HTML in the admin interface. An attacker can intercept and modify the POST /livewire/update request to inject arbitrary HTML or JavaScript into the progressmessage. Because the server accepts the modified input without sanitization and reflects it back to the user, arbitrary JavaScript executes in the browser of any authenticated admin who views the import page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64027?
CVE-2025-64027 is classified as a medium-severity reflected cross-site scripting (XSS) vulnerability.
How do I fix CVE-2025-64027?
To remediate CVE-2025-64027, ensure that your application validates and sanitizes the input from CSV file uploads.
Which versions of Snipe-IT are affected by CVE-2025-64027?
CVE-2025-64027 affects Snipe-IT version 8.3.4 (build 20218) and earlier.
What kind of attack can be executed through CVE-2025-64027?
Attackers can exploit CVE-2025-64027 to inject malicious scripts into the admin interface through manipulated CSV uploads.
Where can I find more information about CVE-2025-64027?
Further details regarding CVE-2025-64027 can be found on the official Snipe-IT repository and security advisories.