CVE-2026-55466: Snipe-IT: Stored XSS via inline-served attachment
Impact A low-privilege user can store an active-content payload as an asset attachment and have it served inline, same-origin, with an active Content-Type, achieving stored XSS. The application sanitizes uploads only when PHP finfo detects image/svg+xml. By submitting an XHTML document whose finfo MIME is text/xml (an allowed extension), the svg-sanitize branch is skipped, the <script> is stored raw, and the inline-serve path returns it as text/xml; charset=utf-8 with Content-Disposition: inline — which the browser renders as a live XHTML document and executes. The dedicated StorageHelper::allowSafeInline() whitelist that should have constrained inline-renderable types is never wired into the serve path.
Details Vulnerable code — sanitizer keyed on finfo MIME app/Http/Requests/UploadFileRequest.php:46-53
php $extension = $file->getClientOriginalExtension(); $filename = $nameprefix.'-'.strrandom(8).'-'.strslug(...).'.'.$file->guessExtension(); ... if ($file->getMimeType() === 'image/svg+xml') { $uploadedfile = $this->handleSVG($file); // svg-sanitize fires } else { $uploadedfile = filegetcontents($file); // stored RAW — no sanitization }
Vulnerable code — inline serve, no allowSafeInline() app/Http/Controllers/UploadedFilesController.php:103
php if (request('inline') == 'true') { $headers = ['Content-Disposition' => 'inline']; return Storage::download($path.$log->filename, $log->filename, $headers); }
StorageHelper::allowSafeInline() (app/Helpers/StorageHelper.php:88) exists to whitelist inline-renderable types but is not called here. The validation rule (UploadFileRequest::rules()) is mimes: over config('filesystems.alloweduploadextensionsforvalidator'), which includes svg, xml, and txt — so a text/xml file passes validation and bypasses the SVG sanitizer simultaneously.
POC 1. From a fresh install, as a user with only assets.view + assets.files targeting any existing asset created by admin 2. click on the asset created by admin and upload files. 3. create a XML file with the following payload and upload it.
xml <?xml version="1.0"?> <html xmlns="http://www.w3.org/1999/xhtml"> <head><script>alert(document.cookie)</script></head> <body>hi</body> </html>
4. Noticed that it did not receive any error and the file was uploaded. 5. Now, can just get the URL and view it. (need to add the inline=true). image.png
Notice that the XSS was able to request document.cookie. This means that it is possible for low privilege user to perform XSS and perform privilege escalation to admin.
Other sources
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline(), allowing a low-privilege user to upload active XHTML or XML content that is later served same-origin and executes JavaScript in a viewer’s browser. This issue is fixed in version 8.6.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.2 - Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.6.2 - Configuration
On the inline-serving code path (UploadedFilesController.php:103), ensure the controller calls StorageHelper::allowSafeInline() to restrict which content types may be served inline; the material states this whitelist exists but is not wired into the serve path, enabling stored XSS.
app/Http/Controllers/UploadedFilesController.php inline serving logic = Use StorageHelper::allowSafeInline() on the inline serve path (and ensure inline=true is constrained by the whitelist instead of serving raw uploaded XML/XHTML). - Configuration
Update upload validation/sanitization so that bypasses caused by finfo MIME detection and allowed inline-serving are prevented (material: sanitizes SVG only when PHP finfo reports image/svg+xml; text/xml passes mimes validation and skips sanitization).
app/Http/Requests/UploadFileRequest.php upload sanitization gating = Do not rely only on PHP finfo MIME 'image/svg+xml' to decide whether SVG/XML content is sanitized; ensure that the sanitizer is applied for uploaded types that may be rendered inline (including text/xml/xhtml that can be served inline).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55466?
The severity of CVE-2026-55466 is classified as medium with a CVSS score of 6.2.
How do I fix CVE-2026-55466?
To fix CVE-2026-55466, update Snipe-IT to version 8.6.2 or later.
What type of vulnerability is CVE-2026-55466?
CVE-2026-55466 is a stored cross-site scripting (XSS) vulnerability.
What are the potential consequences of CVE-2026-55466?
CVE-2026-55466 allows low-privilege users to upload malicious SVG files that can execute scripts in the context of other users.
Who is affected by CVE-2026-55466?
Any installations of Snipe-IT prior to version 8.6.2 are affected by CVE-2026-55466.