PT-2026-89040

Snipe-IT versions before 8.7.0 fail to HTML-escape the employee num field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML function. Attackers can craft a malicious employee num value containing an img tag with an arbitrary...