VulnerableCode Package Details - pkg:composer/snipe/snipe-it@6.2.3

Vulnerabilities affecting this package (50)

Advisory	Summary	Fixed in package version
GHSA-8x9v-8qgj-945x Aliases: CVE-2025-64027	Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability …	There are no reported fixed by versions.
GHSA-fww5-m9wc-jcjc Aliases: CVE-2025-65621	Snipe-IT is vulnerable to stored cross-site scripting Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject …	8.3.4 Vulnerable
GHSA-4g25-wj72-chxg Aliases: CVE-2025-65622	Snipe-IT allows stored XSS via the Locations "Country" field Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, …	8.3.4 Vulnerable
GHSA-h3vp-qwmx-5j25 Aliases: CVE-2025-47226	Grokability Snipe-IT has incorrect authorization for accessing asset information Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.	8.1.0 Vulnerable
GHSA-c9wp-pr7f-hfqm Aliases: CVE-2025-59712	Snipe-IT allows XSS Snipe-IT before 8.1.18 allows XSS.	8.1.18 Vulnerable
GHSA-phwj-fgch-xvrj Aliases: CVE-2025-59713	Snipe-IT allows unsafe deserialization Snipe-IT before 8.1.18 allows unsafe deserialization.	8.1.18 Vulnerable
GHSA-hw9x-8m75-4vjq Aliases: CVE-2024-51093	Cross Site Scripting vulnerability in Snipe-IT v.7.0.13 allows a remote attacker to escalate privileges via an unknown part of the …	There are no reported fixed by versions.
GHSA-57qh-vmjr-5jxg Aliases: CVE-2024-48987	Snipe-IT remote code execution Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the …	7.0.10 Vulnerable
GHSA-544r-fc65-v832 Aliases: CVE-2024-5685	Snipe-IT allows users to promote or demote themselves or other users Users with "User:edit" and "Self:api" permissions can promote or …	6.4.2 Vulnerable
GHSA-xg82-2hrv-hf64 Aliases: CVE-2026-37709	Snipe-IT has insecure permissions in file uploads Insecure Permissions vulnerability in grokability snipe-it versions through 8.4.0, fixed after 2026-03-10 commit …	8.4.1 Vulnerable
GHSA-mghp-5cq4-v6mg Aliases: CVE-2026-44833	Snipe-IT has an open redirect vulnerability Open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via …	8.4.1 Vulnerable
GHSA-r42m-953q-6vjx Aliases: CVE-2026-44831	Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0) ### Impact Users with component view access could be impacted by …	8.4.1 Vulnerable
GHSA-5448-v74m-7mv7 Aliases: CVE-2025-15602	Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment Snipe-IT versions prior to …	8.3.7 Vulnerable
GHSA-f3c5-6cw8-fg57 Aliases: CVE-2026-48492	Snipe-IT's selectlist visibility is too permissive ### Impact The GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user …	There are no reported fixed by versions.
GHSA-mr8g-2mj4-pcq2 Aliases: CVE-2026-49870	Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor` ### Impact `POST /two-factor` had no rate limiting, …	8.6.0 Vulnerable
GHSA-6mmj-jhqj-6c6q Aliases: CVE-2026-55542	Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL ### Impact Snipe-IT S3 signature image retrieval lacks authorization before …	There are no reported fixed by versions.
GHSA-33g4-646g-qwmm Aliases: CVE-2026-55482	Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update ### Impact The `BulkAssetsController::update()` method accepts `company_id` directly from user input without …	There are no reported fixed by versions.
GHSA-hf68-g98v-wp9g Aliases: CVE-2026-55483	Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation ### Impact The `store()` method in both …	8.6.0 Vulnerable
GHSA-p68w-rgmg-3c2v Aliases: CVE-2026-49976	Snipe-IT Vulnerable to User Account Escalation via CSV Import ### Impact The CSV user import in update mode bypasses user-edit …	8.6.0 Vulnerable
GHSA-x667-r589-43m7 Aliases: CVE-2026-55519	Snipe-IT has Improper Authorization in File Deletion (IDOR) ### Impact A vulnerability was identified in Snipe-IT v8.4.0 (build 21280-g91a95dbc6) that …	8.4.1 Vulnerable
GHSA-pwpj-p52h-q484 Aliases: CVE-2026-54329	Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection ### Impact A cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories …	8.6.2 Vulnerable
GHSA-6x4j-8954-5hxm Aliases: CVE-2026-50550	Snipe-IT has a 2FA reset privilege bypass ### Impact A user who can edit other users could reset a superadmin's …	8.5.0 Vulnerable
GHSA-hq28-crg7-95pr Aliases: CVE-2026-44832	Snipe-IT has Privilege Escalation via API Permissions Assignment ### Impact An authenticated user with only `users.edit` permission can escalate their …	8.4.1 Vulnerable 8.4.1 Vulnerable
GHSA-52fw-7fw2-fmv5 Aliases: CVE-2026-48493	Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment ### Impact A user with only users.edit AND api …	8.6.0 Vulnerable 8.6.0 Vulnerable
CVE-2021-4075	snipe-it is vulnerable to Server-Side Request Forgery (SSRF)	There are no reported fixed by versions.
GHSA-6f75-x745-xcpr Aliases: CVE-2026-48507	Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users ### Impact The vulnerability allows a non-admin user holding …	8.6.0 Vulnerable 8.6.0 Vulnerable
GHSA-575r-357h-fhch Aliases: CVE-2026-55516	Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update ### Impact The API endpoint for updating asset maintenance records …	8.6.2 Vulnerable
GHSA-fc33-6w3q-538h Aliases: CVE-2026-55462	Snipe-IT has an authorization bypass on print inventory page ### Impact An authenticated user with only `users.view` can open another …	8.6.1 Vulnerable
GHSA-jhph-5q74-pmfx Aliases: CVE-2026-55466	Snipe-IT vulnerable to stored XSS via inline-served attachment ### Impact A low-privilege user can store an active-content payload as an …	8.6.2 Vulnerable
GHSA-c6f4-wj38-m3g3 Aliases: CVE-2026-55474	Snipe-IT vulnerable to directory traversal in displaySig ### Impact The `displaySig` action in `ActionlogController` serves signature image files from a …	8.5.0 Vulnerable
GHSA-r9r3-g9fp-3q4q Aliases: CVE-2026-55703	Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET ### Impact Any activated account in a company can read every …	8.6.3 Vulnerable
GHSA-3hgv-jr5j-cg9x Aliases: CVE-2026-55694	Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover ### Impact An attacker can completely bypass file-name …	8.6.3 Vulnerable
GHSA-r52f-r9v5-66xr Aliases: CVE-2026-55464	Snipe-IT vulnerable to stored XSS via Markdown custom field ### Impact CommonMark is configured with `html_input => 'escape'`, which blocks …	8.6.2 Vulnerable
GHSA-whrx-mmgr-gpcf Aliases: CVE-2026-55452	Snipe-IT has CSV formula injection in Activity Report export ### Impact In Snipe-IT v8.6.1 and lower, `Actionlog::logaction()` stores the request …	8.6.2 Vulnerable
GHSA-53jc-27pc-x8r8 Aliases: CVE-2026-55476	Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter ### Impact The route POST `/account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?}` accepts `cancel_by_admin` as …	8.6.0 Vulnerable
GHSA-35cr-9hqq-p2mg Aliases: CVE-2026-55515	Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint ### Impact A user with the `reports.view` permission can …	8.6.2 Vulnerable
GHSA-c8qc-wf67-342w Aliases: CVE-2026-61807	Snipe-IT: Stored DOM XSS via table selected-count IDs ### Impact The table component derives data-selected-count-id from the component $name value. …	8.6.2 Vulnerable
GHSA-crv3-j83j-f3r6 Aliases: CVE-2026-55478	Snipe-IT has missing object-level authorization in Kits API ### Impact The API endpoint for adding a license to a predefined …	8.6.2 Vulnerable
GHSA-vgx7-c78r-69w9 Aliases: CVE-2026-55460	Snipe-IT has an authorization bypass on bulk editing users ### Impact An authenticated non-admin user with `users.view` and `users.edit`, but …	8.6.2 Vulnerable
GHSA-j5g3-42wp-gqm3 Aliases: CVE-2026-55843	Snipe-IT has an Improper Privilege Management issue ## Impact The `update()` method in `UsersController` passes the `permission` request field unconditionally …	8.6.0 Vulnerable
GHSA-xr9m-gphc-9p63 Aliases: CVE-2026-55469	Snipe-IT has a path traversal vulnerability via CSV import `image` field ### Impact An authenticated user holding the `import` and …	8.6.2 Vulnerable
GHSA-wg2f-x2c2-c4rp Aliases: CVE-2026-55461	Snipe-IT has an Open Redirect After User Edit ### Impact The user edit flow stores `url()->previous()` into Laravel's intended URL …	8.6.2 Vulnerable
GHSA-8w8c-8mx9-52cw Aliases: CVE-2026-55472	Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation ### Impact When Full Multiple Companies Support and scope_locations_fmcs are …	8.6.2 Vulnerable
GHSA-8frh-vhgh-64cf Aliases: CVE-2026-55479	Snipe-IT has incorrect permission for legacy license checkin API ### Impact The legacy single-seat license checkin flow authorizes the action …	8.6.2 Vulnerable
GHSA-w7qw-5wfv-gwx9 Aliases: CVE-2026-55481	Snipe-IT has CSS Injection via `header_color` Setting ### Impact Because `default.blade.php` is the base layout loaded on every authenticated page, …	8.6.2 Vulnerable
GHSA-5wx7-xq8j-v4qm Aliases: CVE-2026-55475	Snipe-IT's import created_by can be overwritten ### Impact The `created_by` of an import file can be arbitrarily overwritten via the …	8.6.1 Vulnerable
GHSA-c6w2-j4wq-mvwg Aliases: CVE-2026-55643	Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode ### Impact Due to inconsistent authorization checks, a company-scoped user can bypass …	8.6.3 Vulnerable 8.6.3 Vulnerable
GHSA-396x-xmvh-p563 Aliases: CVE-2026-63498	Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API Snipe-IT's uploaded-files API accepts XML documents and later …	8.7.0 Vulnerable
GHSA-hxcx-9h4f-42xx Aliases: CVE-2026-63493	Snipe-IT: 2FA bypass via the API token flow ### Impact An attacker who knows a victim's password fully bypasses that …	8.7.0 Vulnerable
GHSA-p9h3-gvpq-5539 Aliases: CVE-2026-62368	Snipe-IT: Stored XSS via Custom Field name in asset-list column headers ### Impact A user with the "customfields.create" permission can …	8.7.0 Vulnerable

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	9.0