DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-63498: CVE-2026-63498: Stored Cross-Site Scripting via Inline XML Rendering in Snipe-IT API

#security #cve #cybersecurity

CVE-2026-63498: Stored Cross-Site Scripting via Inline XML Rendering in Snipe-IT API

Vulnerability ID: CVE-2026-63498
CVSS Score: 8.7
Published: 2026-09-24

CVE-2026-63498 is a high-severity Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT prior to version 8.7.0. The flaw resides in the REST API's file retrieval endpoint, which allows files to be rendered inline without sanitizing or restricting malicious content types like XML and XSLT stylesheets, leading to browser-side script execution in the context of the application's origin.

TL;DR

Unsafe inline rendering of uploaded XML files in the Snipe-IT REST API allows authenticated users with upload privileges to execute arbitrary client-side JavaScript in the context of other users' sessions, potentially leading to administrative account takeover.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79 (Improper Neutralization of Input During Web Page Generation)
  • Attack Vector: Network (AV:N)
  • CVSS Score: 8.7 (High)
  • Exploit Status: Proof of Concept (PoC) represented in official test suites
  • CISA KEV Status: Not Listed
  • Impact: Complete session compromise and privilege escalation via Stored XSS

Affected Systems

  • Snipe-IT Asset Management System
  • Snipe-IT: < 8.7.0 (Fixed in: 8.7.0)

Code Analysis

Commit: e929b31

Fix inline file delivery logic and implement MIME verification rules

Mitigation Strategies

  • Upgrade Snipe-IT to version 8.7.0 or higher to enforce strict file validation rules.
  • Deploy WAF rules to detect and intercept inline file retrievals containing active XML or XSLT signatures.
  • Force protective headers such as X-Content-Type-Options: nosniff and restrictive Content-Security-Policy sandbox settings at the reverse proxy layer.

Remediation Steps:

  1. Identify all current Snipe-IT production instances and record their running versions.
  2. Back up the application database, configuration files, and stored uploads folder.
  3. Apply the 8.7.0 system upgrade using standard composer and git update utilities.
  4. Validate the fix by attempting to retrieve a test XML file via the API with the inline=true parameter, ensuring it results in a download rather than rendering.

References

Read the full report for CVE-2026-63498 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)