Snipe-IT: Three High-Severity Flaws Including RCE and 2FA Bypass Patched in v8.7.0
Key findings • Three high-severity vulnerabilities in Snipe-IT were disclosed on September 24, 2026. • CVE-2026-63498 allows arbitrary code execution via crafted XML/XSLT file uploads. • …
Key findings
- Three high-severity vulnerabilities in Snipe-IT were disclosed on September 24, 2026.
- CVE-2026-63498 allows arbitrary code execution via crafted XML/XSLT file uploads.
- CVE-2026-62368 enables XSS attacks through unescaped custom field names.
- CVE-2026-63493 permits bypassing two-factor authentication for API access.
- All vulnerabilities are fixed in Snipe-IT version 8.7.0.
On September 24, 2026, a batch of three high-severity vulnerabilities was disclosed for Snipe-IT, an IT asset and license management system. The vulnerabilities, all patched in version 8.7.0, could allow authenticated users to execute arbitrary code, bypass security measures, or facilitate cross-site scripting attacks.
Two of the vulnerabilities, CVE-2026-63498 and CVE-2026-62368, stem from improper handling of user-supplied input. CVE-2026-63498, rated at CVSSv3 8.7, involves an authenticated user with file-management access uploading XML and XSLT attachments via the uploaded-files API endpoint. Requesting these files with the inline=true parameter could lead to arbitrary code execution.
CVE-2026-62368, with a CVSSv3 score of 8.1, allows a user with customfields.create permission to store markup in a custom field's name. This markup is then rendered unescaped as a table header title when other users view an associated asset list, potentially leading to cross-site scripting (XSS) attacks.
The third vulnerability, CVE-2026-63493, bypasses a critical security control. A password-authenticated session for an account with self.api permission can access the personal-access-token API flow before completing the account's two-factor authentication (2FA) challenge. This occurs because the 2FA check is enforced in the web middleware group but not the API middleware group.
All three vulnerabilities were fixed in Snipe-IT version 8.7.0. Users are strongly advised to update to this version to mitigate the risks associated with these high-severity flaws. The timely patching of these issues is crucial for maintaining the security and integrity of IT asset management data.