Snipe Snipe-It vulnerabilities

CVE-2026-55464 [MEDIUM] CWE-79 Snipe-IT vulnerable to stored XSS via Markdown custom field Snipe-IT vulnerable to stored XSS via Markdown custom field ### Impact CommonMark is configured with `html_input => 'escape'`, which blocks raw HTML injection. However, javascript: URIs in Markdown hyperlinks are not sanitized. A user with `assets.edit` permission can inject a malicious link into any markdown-textarea custom field. Any user who opens the asset detail page and clicks the link executes arbi

CVE-2026-55519 [LOW] CWE-285 Snipe-IT has Improper Authorization in File Deletion (IDOR) Snipe-IT has Improper Authorization in File Deletion (IDOR) ### Impact A vulnerability was identified in Snipe-IT v8.4.0 (build 21280-g91a95dbc6) that allows any authenticated user with generic asset edit permissions to delete files attached to any asset in the system, regardless of ownership or company assignment. This constitutes an Insecure Direct Object Reference (IDOR) vulnerability caused by a class-l

CVE-2026-55461 [MEDIUM] CWE-601 Snipe-IT has an Open Redirect After User Edit Snipe-IT has an Open Redirect After User Edit ### Impact The user edit flow stores `url()->previous()` into Laravel's intended URL session value and later redirects with `redirect()->intended(...)` when `redirect_option=back` is submitted. Because the previous URL is derived from the attacker-controlled `Referer` header, an authenticated user performing a normal user-edit action can be redirected to an external attack

CVE-2026-44833 [MEDIUM] CWE-601 Snipe-IT has an open redirect vulnerability Snipe-IT has an open redirect vulnerability Open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. ### Impact - **Phishing**: Redirect users to fake login pages to steal credentials - **Session Hijacking**: Redirect to attacker site that captures session cookies via JavaScript - **Malware Distribution**: Redirect to

CVE-2022-0178 [MEDIUM] CWE-284 Improper Access Control in snipe-it Improper Access Control in snipe-it Users with no system permissions are able to see and create personal access tokens

CVE-2025-65621 [MEDIUM] CWE-269 Snipe-IT is vulnerable to stored cross-site scripting Snipe-IT is vulnerable to stored cross-site scripting Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.

CVE-2022-44381 [MEDIUM] CWE-203 Snipe-IT allows attackers to check whether a user account exists Snipe-IT allows attackers to check whether a user account exists Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.

CVE-2026-55515 [MEDIUM] CWE-639 Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint ### Impact A user with the `reports.view` permission can delete pending checkout acceptance records by global ID, even when the acceptance belongs to an asset in another company. The report listing page appears to scope visible unaccepted assets, but the delete endpoint directl

CVE-2025-65622 [MEDIUM] CWE-79 Snipe-IT allows stored XSS via the Locations "Country" field Snipe-IT allows stored XSS via the Locations "Country" field Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in another user's session.

CVE-2025-64027 [MEDIUM] CWE-79 Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, the application returns a progress_message value that is rendered as raw HTML in the admin interface. An attacker can intercept and modify the POST /livewire/update req

CVE-2022-32060 [MEDIUM] CWE-79 Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding Settings Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding Settings An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.

CVE-2019-10118 [MEDIUM] CWE-79 Snipe-IT XSS Vulnerability Snipe-IT XSS Vulnerability Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.

CVE-2022-1380 [MEDIUM] CWE-79 Cross-site Scripting in snipe-it Cross-site Scripting in snipe-it Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.

CVE-2022-1445 [MEDIUM] CWE-79 Stored cross-site scripting in Snipe-IT Stored cross-site scripting in Snipe-IT Snipe-IT prior to version 5.4.3 is vulnerable to stored cross-site scripting because the input to the `checked_out_to` parameter is not escaped. The vulnerability is capable of stealing a user's cookie.

CVE-2022-32061 [MEDIUM] CWE-79 Snipe-IT 6.0.2 vulnerable to Cross-site Scripting Snipe-IT 6.0.2 vulnerable to Cross-site Scripting An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.

CVE-2026-44831 [MEDIUM] CWE-79 Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0) Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0) ### Impact Users with component view access could be impacted by an unescaped `notes` column. ### Patches This was patched in https://github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438, and is fixed in v8.4.1 or greater. ### Workarounds None.

CVE-2021-3879 [MEDIUM] CWE-79 Cross-site Scripting in snipe-it Cross-site Scripting in snipe-it snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-3863 [MEDIUM] CWE-79 Cross-site Scripting in snipe-it Cross-site Scripting in snipe-it snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-4108 [MEDIUM] CWE-79 snipe-it is vulnerable to Cross-site Scripting snipe-it is vulnerable to Cross-site Scripting snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

CVE-2021-3961 [HIGH] CWE-79 Cross-site Scripting in snipe/snipe-it Cross-site Scripting in snipe/snipe-it snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')