Snipe-IT versions before 8.7.0 have an XSS vulnerability in the GET /api/v1/{object_type}/{id}/files/{file_id} endpoint when the inline=true parameter is used. Authenticated users with file-management permissions can upload XML and XSLT files containing malicious xml-stylesheet references. The controller handling this request does not enforce the safe-inline allowlist, allowing browsers to execute JavaScript generated by the stylesheet. A victim authorized to view the object must open the attachment URL for the script to execute, potentially exposing same-origin data and enabling actions with the victim's privileges. The vulnerability is resolved in version 8.7.0.

An attacker with file-management access can craft malicious XML/XSLT attachments that execute JavaScript in the victim's browser when the victim opens the attachment URL. This can lead to theft of sensitive data accessible under the same origin and execution of authenticated actions on behalf of the victim. The vulnerability requires victim interaction and authenticated victim privileges to be exploited.

Upgrade Snipe-IT to version 8.7.0 or later, where this vulnerability is fixed. No other mitigation is required as the fix addresses the unsafe handling of inline XML/XSLT attachments.