Cross-site scripting in snipe-it - CVE-2026-55466
Published: August 14, 2026
Vulnerability details
The vulnerability allows a remote user to execute arbitrary script in the victim\'s browser in the context of the application.
The vulnerability exists due to improper neutralization of script in uploaded XHTML content in the attachment upload and inline file serving functionality when uploading a crafted XML/XHTML attachment and accessing it with inline serving enabled. A remote user can upload a crafted attachment containing script and have it rendered inline as same-origin active content to execute arbitrary script in the victim\'s browser in the context of the application.
The issue occurs because XML/XHTML content can bypass the SVG sanitization path and is served with Content-Disposition: inline.