The vulnerability allows an authenticated user with file‑management rights to upload XML or XSLT files that include a stylesheet reference and then request those files with inline rendering enabled. Because the API endpoint does not apply the same safe‑inline allowlist as the web interface, the browser processes the malicious stylesheet and executes the embedded JavaScript in the Snipe‑IT origin. This stored XSS can read same‑origin data and perform any action the authenticated user is authorized to do, effectively granting an attacker the victim’s privileges without needing additional credentials.

All installations of the Snipe‑IT asset‑management system running a version earlier than 8.7.0 are affected. The flaw is present in the uploaded‑files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} and is fixed in release 8.7.0 and later.

The CVSS base score is 8.7, indicating high severity. The EPSS score is not available, but the vulnerability requires an attacker to have file‑management access and a legitimate user session to view the object, limiting the attack surface to trusted users. The issue is not listed in the CISA KEV catalog. Exploitation would occur when a victim opens the manipulated attachment URL, leading to the execution of attacker‑controlled JavaScript that can read data and issue commands in the victim’s context.