CVE-2026-55466 is a cross-site scripting vulnerability in grokability's Snipe-IT asset management system. The issue arises because UploadFileRequest sanitizes SVG content only when PHP finfo reports the MIME type as image/svg+xml. Additionally, the UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline(), enabling low-privilege users to upload active XHTML or XML content. This content is later served same-origin, allowing JavaScript execution in the context of the viewer's browser. The vulnerability is addressed in Snipe-IT version 8.6.2.

An attacker with low privileges can upload malicious active XHTML or XML files that execute JavaScript when viewed by other users, leading to potential cross-site scripting attacks. This can result in session hijacking, unauthorized actions, or other malicious behaviors executed in the context of the victim's browser. The CVSS 4.0 score is 6.2 (medium severity), reflecting network attack vector, low attack complexity, and no privileges required beyond low user privileges.

Upgrade Snipe-IT to version 8.6.2 or later, where this vulnerability is fixed. There is no official patch or temporary fix indicated beyond this upgrade. Until upgraded, restrict file upload permissions to trusted users only and avoid serving uploaded SVG or XML files inline without proper sanitization.