https://vulnerability.circl.lu/sightings/feed 2026-10-05T21:47:23.200339+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/3fe51c0d-ff07-4791-a991-a1d4351cff13/export 2026-10-05T21:47:23.228541+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "3fe51c0d-ff07-4791-a991-a1d4351cff13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63498", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwpq5m7jje2e", "content": "\ud83d\udccc CVE-2026-63498 - Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allo... https://www.cyberhub.blog/cves/CVE-2026-63498", "creation_timestamp": "2026-09-30T06:37:07.405407Z"} 2026-09-30T06:37:07.405407+00:00 https://vulnerability.circl.lu/sighting/bc1dc618-87f6-475d-834c-cc958105103f/export 2026-10-05T21:47:23.232485+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "bc1dc618-87f6-475d-834c-cc958105103f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63498", "type": "seen", "source": "https://gist.github.com/alon710/428e2262f37bf99385b17c721990d4f3", "content": "# CVE-2026-63498: CVE-2026-63498: Stored Cross-Site Scripting via Inline XML Rendering in Snipe-IT API\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63498\n\n## Summary\nCVE-2026-63498 is a high-severity Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT prior to version 8.7.0. The flaw resides in the REST API's file retrieval endpoint, which allows files to be rendered inline without sanitizing or restricting malicious content types like XML and XSLT stylesheets, leading to browser-side script execution in the context of the application's origin.\n\n## TL;DR\nUnsafe inline rendering of uploaded XML files in the Snipe-IT REST API allows authenticated users with upload privileges to execute arbitrary client-side JavaScript in the context of other users' sessions, potentially leading to administrative account takeover.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79 (Improper Neutralization of Input During Web Page Generation)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.7 (High)\n- **Exploit Status**: Proof of Concept (PoC) represented in official test suites\n- **CISA KEV Status**: Not Listed\n- **Impact**: Complete session compromise and privilege escalation via Stored XSS\n\n## Affected Systems\n\n- Snipe-IT Asset Management System\n- **Snipe-IT**: < 8.7.0 (Fixed in: `8.7.0`)\n\n## Mitigation\n\n- Upgrade Snipe-IT to version 8.7.0 or higher to enforce strict file validation rules.\n- Deploy WAF rules to detect and intercept inline file retrievals containing active XML or XSLT signatures.\n- Force protective headers such as X-Content-Type-Options: nosniff and restrictive Content-Security-Policy sandbox settings at the reverse proxy layer.\n\n**Remediation Steps:**\n1. Identify all current Snipe-IT production instances and record their running versions.\n2. Back up the application database, configuration files, and stored uploads folder.\n3. Apply the 8.7.0 system upgrade using standard composer and git update utilities.\n4. Validate the fix by attempting to retrieve a test XML file via the API with the inline=true parameter, ensuring it results in a download rather than rendering.\n\n## References\n\n- [GHSA-396x-xmvh-p563: Stored XSS via Inline XML Rendering in the Uploaded Files API](https://github.com/grokability/snipe-it/security/advisories/GHSA-396x-xmvh-p563)\n- [Official Security Patch Commit](https://github.com/grokability/snipe-it/commit/e929b31f0b183c5810bd2b833c1f6f643cbe5284)\n- [Snipe-IT Version 8.7.0 Release Notes](https://github.com/grokability/snipe-it/releases/tag/v8.7.0)\n- [CVE.org Record for CVE-2026-63498](https://www.cve.org/CVERecord?id=CVE-2026-63498)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63498) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-24T19:30:32.000000Z"} 2026-09-24T19:30:32+00:00 https://vulnerability.circl.lu/sighting/fa81d73f-234c-483f-a5ad-177cf8d4a36b/export 2026-10-05T21:47:23.232652+00:00 Joseph Lee https://cvepremium.circl.lu/user/syspect {"uuid": "fa81d73f-234c-483f-a5ad-177cf8d4a36b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63498", "type": "published-proof-of-concept", "source": "https://github.com/grokability/snipe-it/security/advisories/GHSA-396x-xmvh-p563", "content": "", "creation_timestamp": "2026-08-24T14:21:46.000000Z"} 2026-08-24T14:21:46+00:00