Vulnerabilities

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary files on the server and trigger server-side HTTP requests (SSRF), a file/path handling flaw tracked as CWE-73. An attacker submits crafted markdown image syntax in checkout acceptance notes; the syntax survives HTML escaping, is expanded by the CommonMark parser, and the resulting image reference is fetched by laravel-mail-auto-embed using file_get_contents or curl, so the target can be a local file or an attacker-chosen URL. A low-privileged authenticated user gains arbitrary file read (e.g., exfiltrating the .env file, which contains the Laravel APP_KEY and other secrets) and can probe internal services or reach external URLs via the server-side request. All Snipe-IT deployments running any version prior to 8.7.0, where authenticated users can submit notes on checkout acceptance, are affected; the flaw is network-reachable with low privileges required, rated 8.4 High under CVSS 4.0. No public proof-of-concept or confirmed in-the-wild exploitation is currently known, and the issue is not in the CISA KEV catalog.

Do: Upgrade to Snipe-IT 8.7.0 or later, which fixes sanitization of markdown image syntax in note fields. As interim mitigations, restrict or strip markdown image syntax from acceptance notes, limit outbound HTTP connectivity from the Snipe-IT server to block SSRF callbacks, and verify that the web server user cannot read more configuration than necessary; if compromise is suspected, rotate the APP_KEY and any other secrets stored in .env.

Snipe-IT versions before 8.7.0 contain a CSS injection flaw (CWE-79) in the Custom CSS field, where sanitization HTML-encodes greater-than and double-quote characters but then reverses that encoding, allowing crafted CSS containing those characters to pass through unescaped. A superuser can plant a payload built from @import and url() references combined with attribute-selector rules; when other superusers load the application, the injected CSS silently sends their CSRF tokens to attacker-controlled servers. With a stolen CSRF token, the attacker can perform cross-site request forgery actions against the victim's session, achieving takeover of other superuser accounts. Any organization running Snipe-IT prior to 8.7.0 is affected, with risk concentrated in instances that have multiple superusers, one of which is malicious or compromised. Despite a critical 9.3 CVSS 4.0 score, exploitation is currently unknown: there is no public proof-of-concept, no CISA KEV listing, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

Do: Upgrade to Snipe-IT 8.7.0 or later, which fixes the Custom CSS sanitization. Until then, audit the Custom CSS field for unexpected @import, url(), or attribute-selector payloads, restrict superuser accounts to trusted administrators, and consider limiting outbound network access from the Snipe-IT server to block token exfiltration. Deployments with only a single superuser have little practical exposure unless that account itself is compromised.