A high-severity cross-site scripting vulnerability in Snipe-IT allows authenticated users to execute malicious scripts, potentially leading to unauthorized actions and data compromise.

This vulnerability occurs in the API endpoint used for file management, where the application fails to properly sanitize XML and XSLT attachments. An authenticated user with file-management privileges can leverage this flaw to trigger cross-site scripting, allowing them to execute JavaScript in the victim's browser session.

The successful exploitation of this vulnerability allows an attacker to perform actions on behalf of an authenticated user, including administrators. Given the CVSS score of 8.7, this represents a significant risk to the integrity and confidentiality of the asset management system, potentially resulting in unauthorized administrative changes or the exposure of sensitive internal data.

Immediate Action: Upgrade the Snipe-IT installation to version 8.7.0 or later to implement the required input validation and safe-inline allowlist.

Proactive Monitoring: Review web server and application logs for suspicious API requests involving XML or XSLT file types that target the uploaded-files controller.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect file uploads for malicious XML content and restrict access to the affected API endpoints to trusted users only.

Public Exploit Available: No confirmed public exploit is available.

Organizations utilizing Snipe-IT should treat this vulnerability with high urgency due to the risk of privilege escalation via session hijacking. Administrators must prioritize the update to version 8.7.0 to ensure the application correctly neutralizes malicious stylesheet references and prevents script execution in the application context.