CVE-2026-55466 is a cross-site scripting vulnerability in the Snipe-IT IT asset/license management system before version 8.6.2. The issue arises because the UploadFileRequest sanitizes SVG content only when PHP finfo reports the MIME type as image/svg+xml. Additionally, the UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline(), which would restrict unsafe content. This combination allows a low-privilege user to upload active XHTML or XML content that is served same-origin and can execute JavaScript in the browser of anyone viewing the attachment. The vulnerability is addressed in Snipe-IT version 8.6.2.

An attacker with low privileges can upload malicious active XHTML or XML content disguised as SVG files. When these files are served inline by the application without proper sanitization, they can execute arbitrary JavaScript in the context of the victim's browser, leading to potential session hijacking, data theft, or other malicious actions. The CVSS 4.0 base score is 6.2 (medium severity), reflecting network attack vector, low complexity, no privileges required beyond low user, and user interaction needed.

Upgrade Snipe-IT to version 8.6.2 or later, where this vulnerability is fixed. The fix involves proper sanitization of SVG content regardless of MIME type detection and serving attachments inline only with safe inline handling. No other mitigation steps are indicated or required according to the available data.