{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-63498/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:snipe_it:snipe_it:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.7,"id":"CVE-2026-63498"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Snipe-IT (\u003c 8.7.0)"],"_cs_severities":["high"],"_cs_tags":["web-application","xss","cve-2026-63498","web-vulnerability","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["Snipe-IT"],"content_html":"\u003cp\u003eSnipe-IT is vulnerable to stored cross-site scripting (XSS) via its uploaded-files API (CVE-2026-63498). The vulnerability exists because the API endpoint \u003ccode\u003eGET /api/v1/{object_type}/{id}/files/{file_id}\u003c/code\u003e honors an attacker-controlled \u003ccode\u003einline=true\u003c/code\u003e query parameter for all uploaded files without verifying the safety of the content. While the non-API web controller correctly utilizes \u003ccode\u003eStorageHelper::allowSafeInline()\u003c/code\u003e to sanitize inline responses, the API controller fails to perform this check.\u003c/p\u003e\n\u003cp\u003eAn authenticated user with permission to upload files can upload a malicious XSLT stylesheet and an XML document that references it via the \u003ccode\u003exml-stylesheet\u003c/code\u003e instruction. When a victim views the XML file through the API with the \u003ccode\u003einline=true\u003c/code\u003e parameter, the browser parses the XSLT and executes the embedded JavaScript within the context of the Snipe-IT origin. This allows the attacker to perform unauthorized actions on behalf of the victim, access sensitive information, or escalate privileges if a superuser is targeted. The vulnerability was reproduced in versions prior to 8.7.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the Snipe-IT instance with a user account permitted to upload files to at least one object.\u003c/li\u003e\n\u003cli\u003eAttacker prepares a malicious XSLT file containing an embedded payload (e.g., \u003ccode\u003e\u0026lt;script\u0026gt;...\u0026lt;/script\u0026gt;\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker uses the API \u003ccode\u003ePOST /api/v1/{object_type}/{id}/files\u003c/code\u003e to upload the XSLT stylesheet; the system stores the file as \u003ccode\u003etext/xml\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker records the assigned ID of the stored XSLT file.\u003c/li\u003e\n\u003cli\u003eAttacker creates an XML document containing an \u003ccode\u003e\u0026lt;?xml-stylesheet ...?\u0026gt;\u003c/code\u003e processing instruction pointing to the URL of the previously uploaded XSLT file.\u003c/li\u003e\n\u003cli\u003eAttacker uploads the referencing XML document via the same API endpoint and records its ID.\u003c/li\u003e\n\u003cli\u003eAttacker lures an authenticated victim to visit the URL \u003ccode\u003e.../files/{DATA_FILE_ID}?inline=true\u003c/code\u003e within the Snipe-IT application.\u003c/li\u003e\n\u003cli\u003eVictim's browser loads the XML, interprets the stylesheet instruction, and executes the embedded JavaScript in the Snipe-IT session context.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for complete compromise of the victim's session within the Snipe-IT application. Consequences include the ability to read same-origin data (asset, user, and license information), perform authenticated state-changing actions, and potentially achieve full administrative account compromise if a superuser interacts with the malicious file.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Snipe-IT to version 8.7.0 or later to ensure the API controller correctly implements \u003ccode\u003eStorageHelper::allowSafeInline()\u003c/code\u003e for file downloads.\u003c/li\u003e\n\u003cli\u003eReview recent access logs for the \u003ccode\u003e/api/v1/*/files/*\u003c/code\u003e endpoints to identify unusual file upload patterns, particularly involving XML content.\u003c/li\u003e\n\u003cli\u003eLimit file upload permissions to the minimum number of users required for business operations to reduce the attack surface.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-24T20:08:24Z","date_published":"2026-09-24T20:07:51Z","id":"https://feed.craftedsignal.io/briefs/2026-09-snipe-it-xss/","summary":"Snipe-IT contains a stored XSS vulnerability in the uploaded-files API due to the failure to apply safe-inline allowlists to XML documents, allowing authenticated attackers to execute arbitrary JavaScript in the victim's session context via CVE-2026-63498.","title":"Stored XSS in Snipe-IT Uploaded Files API","url":"https://feed.craftedsignal.io/briefs/2026-09-snipe-it-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-63498","version":"https://jsonfeed.org/version/1.1"}