XSLT Injection Vulnerability in Snipe-IT IT Asset Management System
CVE-2026-63498

8.7HIGH

Key Information:

Vendor: Grokability
Status: Snipe-it
Vendor: CVE Published:; 24 September 2026

🔔 Create Grokability Vulnerability Alert

What is CVE-2026-63498?

The Snipe-IT IT asset management system exhibits a vulnerability in its uploaded-files API endpoint that enables an authenticated user with file-management rights to upload malicious XML and XSLT files. When these files are requested with the inline=true parameter, the system fails to apply the necessary safe-inline allowlist, which allows the execution of JavaScript from an attacker-controlled XML stylesheet. This vulnerability can lead to unauthorized access, allowing the act of reading same-origin data and executing authenticated actions on behalf of the victim, provided the victim opens the manipulated attachment URL. This issue has been resolved in version 8.7.0.