CyberRota Analysis
AI-GeneratedThe vulnerability affects Snipe-IT versions prior to 8.6.2, allowing low-privilege users to upload malicious SVG files that can execute JavaScript in the browser of any viewer due to insufficient content sanitization. This poses a significant risk of cross-site scripting (XSS) attacks, potentially compromising user data and system integrity. Organizations using Snipe-IT for IT asset management should prioritize upgrading to version 8.6.2 to mitigate this high-severity threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline(), allowing a low-privilege user to upload active XHTML or XML content that is later served same-origin and executes JavaScript in a viewer’s browser. This issue is fixed in version 8.6.2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)