CVE-2026-61807 Snipe-IT: Stored DOM XSS via table selected-count IDs
Attackers can execute JavaScript in authenticated users' browsers via stored XSS in manufacturer or supplier names, potentially exposing session data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-61807?
CVE-2026-61807 is a medium-severity cross-site scripting vulnerability in Snipeitapp Snipe-It, published on 19 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a selector, concatenates countId.substring(1) into an HTML string, and passes the string to jQuery .after(). A crafted name can therefore execute JavaScript when an authenticated user views the manufacturer detail page or supplier detail page, potentially exposing data or actions available to that session. This issue is fixed in version 8.6.2.
Weakness: CWE-79
Which versions are affected by CVE-2026-61807?
2 open source packages ship an affected version, including snipe/snipe-it. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
snipe/snipe-it Packagist | All versions | 8.6.2 |
snipe/snipe-it Packagist | All versions | 8.6.2 |
Products include Snipeitapp Snipe-It.
How do I fix CVE-2026-61807?
Upgrade snipe/snipe-it to 8.6.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-61807 being exploited?
There is no known exploitation of CVE-2026-61807 in the wild and no public exploit code.
Other vulnerabilities in Snipeitapp Snipe-It
- CVE-2025-63601 File upload in n/a
- CVE-2026-37709 Snipe-IT has insecure permissions in file uploads
- CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS
- CVE-2026-116199 Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback
- CVE-2022-1380 Stored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it
Sources
Also known as GHSA-c8qc-wf67-342w.