Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-62368, is a stored XSS in Snipe-IT. The core issue lies in the app/Presenters/AssetPresenter.php file, specifically within the dataTableLayout function. This function is responsible for generating the layout of the asset list table, including column headers derived from custom field names. Prior to the patch, the custom field name ($field->name) was directly assigned to the 'title' attribute of the column header without any escaping. This allowed an attacker to create a custom field with a name containing malicious HTML or JavaScript. When any user, including a superuser, viewed an asset list (e.g., /hardware), the unescaped malicious payload in the column header would execute in their browser, leading to privilege escalation. The patch explicitly adds e($field->name) to escape the custom field name, preventing the injection. Therefore, the dataTableLayout function, specifically the line assigning the title, was the point of vulnerability.
AssetPresenter.dataTableLayoutapp/Presenters/AssetPresenter.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| snipe/snipe-it | composer | < 8.7.0 | 8.7.0 |