1531 matches found
Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation
Impact When Full Multiple Companies Support and scopelocationsfmcs are both enabled, the API endpoint for creating locations can still create a child location under a parent location from a different company. The code detects the invalid parent/child company mismatch, but it appears not to return...
GHSA-8W8C-8MX9-52CW Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation
Impact When Full Multiple Companies Support and scopelocationsfmcs are both enabled, the API endpoint for creating locations can still create a child location under a parent location from a different company. The code detects the invalid parent/child company mismatch, but it appears not to return...
Snipe-IT has a path traversal vulnerability via CSV import `image` field
Impact An authenticated user holding the import and assets.update permissions can delete arbitrary files on the server filesystem by injecting a path traversal string into an asset's image field via CSV import, then triggering the image deletion feature...
GHSA-XR9M-GPHC-9P63 Snipe-IT has a path traversal vulnerability via CSV import `image` field
Impact An authenticated user holding the import and assets.update permissions can delete arbitrary files on the server filesystem by injecting a path traversal string into an asset's image field via CSV import, then triggering the image deletion feature...
EUVD-2026-43000
Snipe-IT has a path traversal vulnerability via CSV import image field...
Snipe-IT vulnerable to stored XSS via inline-served attachment
Impact A low-privilege user can store an active-content payload as an asset attachment and have it served inline, same-origin, with an active Content-Type, achieving stored XSS. The application sanitizes uploads only when PHP finfo detects image/svg+xml. By submitting an XHTML document whose finf...
EUVD-2026-42996
Snipe-IT vulnerable to stored XSS via inline-served attachment...
GHSA-JHPH-5Q74-PMFX Snipe-IT vulnerable to stored XSS via inline-served attachment
Impact A low-privilege user can store an active-content payload as an asset attachment and have it served inline, same-origin, with an active Content-Type, achieving stored XSS. The application sanitizes uploads only when PHP finfo detects image/svg+xml. By submitting an XHTML document whose finf...
EUVD-2026-42992
Snipe-IT vulnerable to stored XSS via Markdown custom field...
Snipe-IT vulnerable to stored XSS via Markdown custom field
Impact CommonMark is configured with htmlinput = 'escape', which blocks raw HTML injection. However, javascript: URIs in Markdown hyperlinks are not sanitized. A user with assets.edit permission can inject a malicious link into any markdown-textarea custom field. Any user who opens the asset deta...
GHSA-R52F-R9V5-66XR Snipe-IT vulnerable to stored XSS via Markdown custom field
Impact CommonMark is configured with htmlinput = 'escape', which blocks raw HTML injection. However, javascript: URIs in Markdown hyperlinks are not sanitized. A user with assets.edit permission can inject a malicious link into any markdown-textarea custom field. Any user who opens the asset deta...
EUVD-2026-42994
Snipe-IT has an authorization bypass on print inventory page...
Snipe-IT has an authorization bypass on print inventory page
Impact An authenticated user with only users.view can open another user's detail page and see assigned license, accessory, and consumable data even though the same account is denied direct access to the Licenses, Accessories, and Consumables modules. The leaked data includes software license name...
GHSA-FC33-6W3Q-538H Snipe-IT has an authorization bypass on print inventory page
Impact An authenticated user with only users.view can open another user's detail page and see assigned license, accessory, and consumable data even though the same account is denied direct access to the Licenses, Accessories, and Consumables modules. The leaked data includes software license name...
GHSA-WG2F-X2C2-C4RP Snipe-IT has an Open Redirect After User Edit
Impact The user edit flow stores url-previous into Laravel's intended URL session value and later redirects with redirect-intended... when redirectoption=back is submitted. Because the previous URL is derived from the attacker-controlled Referer header, an authenticated user performing a normal...
EUVD-2026-42999
Snipe-IT has an Open Redirect After User Edit...
Snipe-IT has an Open Redirect After User Edit
Impact The user edit flow stores url-previous into Laravel's intended URL session value and later redirects with redirect-intended... when redirectoption=back is submitted. Because the previous URL is derived from the attacker-controlled Referer header, an authenticated user performing a normal...
EUVD-2026-42991
Snipe-IT has an authorization bypass on bulk editing users...
Snipe-IT has an authorization bypass on bulk editing users
Impact An authenticated non-admin user with users.view and users.edit, but without users.delete, can directly POST to /users/bulksave and soft-delete another non-admin user. The UI and confirmation route require users.delete, but the destructive sink only authorizes update. Attacker Model...
GHSA-VGX7-C78R-69W9 Snipe-IT has an authorization bypass on bulk editing users
Impact An authenticated non-admin user with users.view and users.edit, but without users.delete, can directly POST to /users/bulksave and soft-delete another non-admin user. The UI and confirmation route require users.delete, but the destructive sink only authorizes update. Attacker Model...