CVE-2026-55466 – Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest …

Vuln ID: CVE-2026-55466

Published:  2026-07-10  20:16:46.970

Description: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline(), allowing a low-privilege user to upload active XHTML or XML content that is later served same-origin and executes JavaScript in a viewer’s browser. This issue is fixed in version 8.6.2.

Base Score: –

Vector:

Source: NVD.NIST.GOV

 

Date:

Categorie(s):

Tag(s):