CVE-2026-63498

The Snipe-IT IT asset management system is vulnerable to Stored XSS in versions prior to 8.7.0 . The vulnerability exists in the uploaded-files API endpoint (GET /api/v1/{object_type}/{id}/files/{file_id}) because the app/Http/Controllers/Api/UploadedFilesController.php show path fails to apply t...