CVE-2022-32060: Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding Settings

The vulnerability occurs in the Branding Settings update functionality where favicon uploads are processed. The PoC demonstrates XSS execution via SVG file upload, indicating insufficient file type validation and content sanitization. In Laravel-based applications like Snipe-IT, this would typically be handled by a controller method responsible for processing branding settings updates. The combination of arbitrary file upload and subsequent XSS execution strongly points to the file upload handler in the branding settings controller as the vulnerable function.