{"vulnerability": "cve-2026-6349", "sightings": [{"uuid": "d6bf439a-68fb-4f6e-ba19-31654d7984fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-6349", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116412503035182529", "content": "", "creation_timestamp": "2026-04-16T04:30:28.846184Z"}, {"uuid": "a3da912a-ba82-4b20-b2ce-70799d717f5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6349", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjln2ddzvz2r", "content": "", "creation_timestamp": "2026-04-16T05:03:26.159241Z"}, {"uuid": "2a5be727-d239-471a-aba2-b545bf50d9a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-6349", "type": "seen", "source": "https://www.twcert.org.tw/en/cp-139-10841-4f504-2.html", "content": "", "creation_timestamp": "2026-04-15T18:44:00.000000Z"}, {"uuid": "76053219-7bb0-445f-9543-7c47e4627d2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6349", "type": "seen", "source": "Telegram/RpCSTqHfWBqrKG53EyhvOrMVfWJfX1b8PG9fT94i9MHNW6c", "content": "", "creation_timestamp": "2026-04-16T05:18:09.000000Z"}, {"uuid": "4b008a6f-8913-49c8-812b-e5c115def097", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63490", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtjpvjbeij2o", "content": "\ud83d\udfe0 CVE-2026-63490 - High (7.5)\n\nHandlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, co...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63490/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-20T17:01:03.070823Z"}, {"uuid": "72d6e1e6-48b2-4376-a8f0-5063811a9792", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63490", "type": "seen", "source": "https://gist.github.com/alon710/ac9a336078ecd53e84e4088322a7f9af", "content": "# CVE-2026-63490: CVE-2026-63490: Path Traversal and Arbitrary File Disclosure in Handlebars.java\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63490\n\n## Summary\nCVE-2026-63490 is a critical path traversal vulnerability in the Spring MVC integration of Handlebars.java. It allows unauthenticated remote attackers to bypass suffix validation and retrieve arbitrary system files via crafted dynamic view names.\n\n## TL;DR\nUnauthenticated path traversal in Handlebars.java allows arbitrary file retrieval by exploiting a parser discrepancy between Java's URL resolver and template suffix enforcement.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22, CWE-23, CWE-552\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.0047\n- **Impact**: Arbitrary File Disclosure\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications implementing handlebars-springmvc below version 4.5.3\n- **handlebars-springmvc**: < 4.5.3 (Fixed in: `4.5.3`)\n\n## Mitigation\n\n- Upgrade Handlebars.java dependency to version 4.5.3 or later\n- Refactor controller logic to avoid direct user influence on MVC view names\n- Implement strong input filtering for URL protocols and URL delimiters in controller paths\n\n**Remediation Steps:**\n1. Open the build configuration file (pom.xml or build.gradle).\n2. Locate the dependency for com.github.jknack:handlebars-springmvc.\n3. Update the version string to 4.5.3.\n4. Rebuild and deploy the application.\n5. Ensure view names returned by controllers are resolved against a static, validated list of templates.\n\n## References\n\n- [GitHub Security Advisory GHSA-g29j-rwfv-h99w](https://github.com/jknack/handlebars.java/security/advisories/GHSA-g29j-rwfv-h99w)\n- [CVE-2026-63490 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-63490)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63490) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T11:31:46.882222Z"}, {"uuid": "bc1dc618-87f6-475d-834c-cc958105103f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63498", "type": "seen", "source": "https://gist.github.com/alon710/428e2262f37bf99385b17c721990d4f3", "content": "# CVE-2026-63498: CVE-2026-63498: Stored Cross-Site Scripting via Inline XML Rendering in Snipe-IT API\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63498\n\n## Summary\nCVE-2026-63498 is a high-severity Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT prior to version 8.7.0. The flaw resides in the REST API's file retrieval endpoint, which allows files to be rendered inline without sanitizing or restricting malicious content types like XML and XSLT stylesheets, leading to browser-side script execution in the context of the application's origin.\n\n## TL;DR\nUnsafe inline rendering of uploaded XML files in the Snipe-IT REST API allows authenticated users with upload privileges to execute arbitrary client-side JavaScript in the context of other users' sessions, potentially leading to administrative account takeover.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79 (Improper Neutralization of Input During Web Page Generation)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.7 (High)\n- **Exploit Status**: Proof of Concept (PoC) represented in official test suites\n- **CISA KEV Status**: Not Listed\n- **Impact**: Complete session compromise and privilege escalation via Stored XSS\n\n## Affected Systems\n\n- Snipe-IT Asset Management System\n- **Snipe-IT**: < 8.7.0 (Fixed in: `8.7.0`)\n\n## Mitigation\n\n- Upgrade Snipe-IT to version 8.7.0 or higher to enforce strict file validation rules.\n- Deploy WAF rules to detect and intercept inline file retrievals containing active XML or XSLT signatures.\n- Force protective headers such as X-Content-Type-Options: nosniff and restrictive Content-Security-Policy sandbox settings at the reverse proxy layer.\n\n**Remediation Steps:**\n1. Identify all current Snipe-IT production instances and record their running versions.\n2. Back up the application database, configuration files, and stored uploads folder.\n3. Apply the 8.7.0 system upgrade using standard composer and git update utilities.\n4. Validate the fix by attempting to retrieve a test XML file via the API with the inline=true parameter, ensuring it results in a download rather than rendering.\n\n## References\n\n- [GHSA-396x-xmvh-p563: Stored XSS via Inline XML Rendering in the Uploaded Files API](https://github.com/grokability/snipe-it/security/advisories/GHSA-396x-xmvh-p563)\n- [Official Security Patch Commit](https://github.com/grokability/snipe-it/commit/e929b31f0b183c5810bd2b833c1f6f643cbe5284)\n- [Snipe-IT Version 8.7.0 Release Notes](https://github.com/grokability/snipe-it/releases/tag/v8.7.0)\n- [CVE.org Record for CVE-2026-63498](https://www.cve.org/CVERecord?id=CVE-2026-63498)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63498) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-24T19:30:32.000000Z"}, {"uuid": "cc268604-429a-47d8-8d3a-21995e4c9109", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63493", "type": "published-proof-of-concept", "source": "https://github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx", "content": "", "creation_timestamp": "2026-08-24T14:21:36.000000Z"}, {"uuid": "00710cd9-1a11-409e-81f3-b5ac93b61d9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63493", "type": "seen", "source": "https://gist.github.com/alon710/6b2fccc524523c2e698955d59741fc2e", "content": "# CVE-2026-63493: CVE-2026-63493: Multi-Factor Authentication Bypass via Stateless API Token Flow in Snipe-IT\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63493\n\n## Summary\nSnipe-IT prior to version 8.7.0 is vulnerable to an authentication bypass (CVE-2026-63493 / GHSA-hxcx-9h4f-42xx) within its Laravel Passport API integration. When multi-factor authentication (MFA/2FA) is enabled, an attacker possessing a victim's password can bypass MFA controls completely. This occurs because the Laravel middleware that enforces MFA was registered only in the stateful 'web' middleware group, leaving the stateless 'api' middleware group unguarded. Consequently, an attacker can use a valid password to initiate a session, bypass the MFA prompt on the web UI by communicating directly with the API, and generate a long-lived Personal Access Token (PAT) to perform unauthorized operations.\n\n## TL;DR\nFlawed session validation allows password-authenticated users to bypass multi-factor authentication (MFA) by interacting directly with the API middleware group to generate persistent access tokens.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-288\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.6 (High)\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **EPSS Score**: Not available\n- **CISA KEV Status**: Not listed\n\n## Affected Systems\n\n- Snipe-IT\n- **Snipe-IT**: < 8.7.0 (Fixed in: `8.7.0`)\n\n## Mitigation\n\n- Upgrade Snipe-IT to version 8.7.0 or higher.\n- Revoke all active Personal Access Tokens (PATs) for unverified or suspicious sessions.\n- Isolate the API endpoints (/api/v1/*) behind secure network perimeters such as VPNs or IP allowlists.\n\n**Remediation Steps:**\n1. Verify current Snipe-IT version in use.\n2. Apply the update to version 8.7.0 or later using official git or release channels.\n3. Inspect the database tables 'oauth_access_tokens' for any tokens created during the suspected compromise window.\n4. Enforce global 2FA and require all users to re-enroll if their settings were altered.\n5. Configure monitoring alerts on the /two_factor_reset API endpoint.\n\n## References\n\n- [GitHub Security Advisory GHSA-hxcx-9h4f-42xx](https://github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx)\n- [CVE Record CVE-2026-63493](https://www.cve.org/CVERecord?id=CVE-2026-63493)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63493) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-24T17:30:29.000000Z"}, {"uuid": "fa81d73f-234c-483f-a5ad-177cf8d4a36b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63498", "type": "published-proof-of-concept", "source": "https://github.com/grokability/snipe-it/security/advisories/GHSA-396x-xmvh-p563", "content": "", "creation_timestamp": "2026-08-24T14:21:46.000000Z"}, {"uuid": "ba233b23-f044-4477-9d4a-52df827004dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63490", "type": "seen", "source": "https://bsky.app/profile/euvd-bot.bsky.social/post/3mwpaof6n7227", "content": "\ud83d\udea8 EUVD-2026-89555\n\ud83d\udcca 7.5/10\n\ud83c\udfe2 jknack\n\n\ud83d\udcdd Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates tem...\n\n\ud83d\udd17 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-89555\n\n#cybersecurity #infosec #cve #euvd", "creation_timestamp": "2026-09-30T02:00:10.590369Z"}, {"uuid": "3fe51c0d-ff07-4791-a991-a1d4351cff13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63498", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwpq5m7jje2e", "content": "\ud83d\udccc CVE-2026-63498 - Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allo... https://www.cyberhub.blog/cves/CVE-2026-63498", "creation_timestamp": "2026-09-30T06:37:07.405407Z"}, {"uuid": "857263e5-5191-493b-9582-944e145f7945", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63493", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwpyjt5jaz2e", "content": "\ud83d\udccc CVE-2026-63493 - Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach ... https://www.cyberhub.blog/cves/CVE-2026-63493", "creation_timestamp": "2026-09-30T09:07:07.755078Z"}]}