Snipe‑IT, an IT asset and license management system built by grokability, contains a CWE‑79 weakness that allows a low‑privilege user to upload a file with active XHTML or XML content. Because the platform only sanitizes SVG files and serves attachments inline without enforcing the StorageHelper::allowSafeInline() check, the malicious file is delivered directly to the user’s web browser from the same origin, executing the embedded JavaScript in the victim’s client and enabling arbitrary script execution on the browser side.

All installations of Snipe‑IT produced by grokability that run a version earlier than 8.6.2 are vulnerable. Version 8.6.2 and later sanitize SVG correctly and prevent unsafe inline serving, thereby eliminating the flaw.

The CVSS score of 6.2 denotes a moderate severity vulnerability. With an EPSS score of less than 1 % and no listing in the CISA KEV catalog, the probability of early exploitation is low, but not negligible. Attacking an instance requires the ability to upload an attachment; once uploaded, the content is served inline without additional safety checks. The attack proceeds entirely in the victim’s browser, so the impact is client‑side script execution exposing potential data or enabling further lateral moves from that compromised session.