CVE-2026-55466 — Vulnerability intelligence
snipeitapp — snipe-it
Published:
- CVSS
- 6.2
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline(), allowing a low-privilege user to upload active XHTML or XML content that is later served same-origin and executes JavaScript in a viewer’s browser. This issue is fixed in version 8.6.2.