Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow

published 2025-11-20 11 mo ago modified 2026-11-05 4 d ago also GHSA-8x9v-8qgj-945x , EUVD-2025-198298

cvss: 6.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 16%
public exploits: 0; none known

Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, the application returns a progress_message value that is rendered as raw HTML in the admin interface. An attacker can intercept and modify the POST /livewire/update request to inject arbitrary HTML or JavaScript into the progress_message. Because the server accepts the modified input without sanitization and reflects it back to the user, arbitrary JavaScript executes in the browser of any authenticated admin who views the import page. NOTE: this is disputed by the Supplier because the report only demonstrates that an authenticated user can choose to conduct a man-in-the-middle attack against himself.

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 11 mo ago (2025-11-20)

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/cybercrewinc/CVE-2025-64027/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	snipe/snipe-it	<=8.3.4	no fix listed

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

github.com /cybercrewinc/CVE-2025-64027/
exploit, third-party-advisory
github.com /grokability/snipe-it
package, product
nvd.nist.gov /vuln/detail/CVE-2025-64027
advisory
github.com /cybercrewinc/CVE-2025-64027
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary