CVE-2026-63498 HIGH

Mô tả

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The app/Http/Controllers/Api/UploadedFilesController.php show() path does not apply the safe-inline allowlist used by the equivalent web controller, so the browser can process an attacker-controlled xml-stylesheet reference and execute JavaScript generated by the stylesheet in the Snipe-IT origin. A victim who is authorized to view the object must open the attachment URL, after which the script can read same-origin data and perform authenticated actions with the victim's privileges. This issue is fixed in version 8.7.0.

Sản phẩm bị ảnh hưởng

Nguồn dữ liệu chưa cung cấp thông tin sản phẩm chi tiết.

Tài liệu tham khảo

• [security-advisories@github.com] https://github.com/grokability/snipe-it/commit/e929b31f0b183c5810bd2b833c1f6f643cbe5284
• [security-advisories@github.com] https://github.com/grokability/snipe-it/releases/tag/v8.7.0
• [security-advisories@github.com] https://github.com/grokability/snipe-it/security/advisories/GHSA-396x-xmvh-p563
• [134c704f-9b21-4f2e-91b3-4a467353bcc0] https://github.com/grokability/snipe-it/security/advisories/GHSA-396x-xmvh-p563

Lịch sử thay đổi