CVE-2026-61807: 
PHP vulnerability analysis and mitigation

CVE-2026-61807 is a stored DOM-based Cross-Site Scripting (XSS) vulnerability in Snipe-IT, an open-source IT asset and license management system. A crafted manufacturer or supplier name stored in the application is rendered as the data-selected-count-id attribute in the bootstrap-table component (resources/views/partials/bootstrap-table.blade.php); client-side JavaScript then reads the browser-decoded value and passes it unsanitized to jQuery .after(), enabling arbitrary JavaScript execution. All versions prior to 8.6.2 (i.e., ≤ 8.6.1) are affected. The vulnerability was published on June 24, 2026, and carries a CVSS v4.0 base score of 6.3 (Medium) (Github Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerable code path flows as follows: a stored manufacturer or supplier name is passed as the $name parameter to the bootstrap-table Blade component, which sets it as the data-selected-count-id HTML attribute. The browser HTML-decodes this attribute value, and the client-side updateSelectedCount() function reads it via jQuery .data(), then concatenates countId.substring(1) directly into an HTML string supplied to jQuery .after() — inserting attacker-controlled markup into the DOM. An example payload for the name field is x[foo=">"]>, which breaks out of the attribute context and injects executable HTML. Exploitation requires the attacker to have at least low-privileged authenticated access to create or modify manufacturer/supplier records, and a separate authenticated victim must view the affected detail page (Github Advisory, Patch Commit).

Successful exploitation allows arbitrary JavaScript to execute in the browser session of any authenticated Snipe-IT user who views the poisoned manufacturer or supplier detail page. If the victim holds elevated privileges (e.g., administrator), the attacker can access or exfiltrate data visible to that session, forge actions on the victim's behalf (such as modifying assets or user records), or steal session tokens. The subsequent system confidentiality and integrity impacts are rated High, reflecting the potential for significant privilege escalation within the application (Github Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is 0.0, indicating a very low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated attacker with permission to create or edit manufacturer or supplier records, and a separate authenticated user must visit the affected page, limiting the attack surface somewhat.

1. Gain authenticated access: Log in to the target Snipe-IT instance (version ≤ 8.6.1) with an account that has permission to create or edit manufacturer or supplier records.
2. Craft a malicious name: Prepare a payload designed to break out of the data-selected-count-id attribute context and inject executable HTML. An example payload is: x[foo=">"]><img src=x onerror=alert(document.cookie)>
3. Store the payload: Navigate to the Manufacturers or Suppliers section and create or edit a record, entering the crafted payload as the name field. Save the record.
4. Trigger victim interaction: Wait for (or socially engineer) an authenticated user — ideally with elevated privileges — to visit the manufacturer or supplier detail page containing the poisoned record.
5. JavaScript executes: When the victim's browser renders the page, the bootstrap-table component sets data-selected-count-id to the stored name. jQuery decodes the attribute, and the updateSelectedCount() function concatenates countId.substring(1) into an HTML string passed to .after(), causing the injected script to execute in the victim's browser session.
6. Achieve objective: The attacker's JavaScript can steal session cookies, exfiltrate sensitive asset data visible to the victim, or perform unauthorized actions (e.g., API calls) on behalf of the victim (Github Advisory, Patch Commit).

• Application Logs: Unusual manufacturer or supplier names containing characters such as [, ], >, <, ", or JavaScript keywords (onerror, script, alert, fetch, document.cookie) in Snipe-IT audit/activity logs.
• Network: Unexpected outbound HTTP requests from authenticated user browsers to external domains shortly after viewing manufacturer or supplier detail pages (potential data exfiltration via XSS beacon).
• Browser/Session: Reports of unexpected pop-ups, redirects, or session anomalies from users who recently visited manufacturer or supplier detail pages.
• Database: Manufacturer or supplier records with names containing HTML special characters or JavaScript payloads (e.g., <, >, onerror=, <script>) when reviewing stored data directly.

Upgrade Snipe-IT to version 8.6.2 or later, which resolves the vulnerability by replacing jQuery selector parsing and HTML string concatenation with safe DOM APIs (document.getElementById, jQuery element constructors, and document.createTextNode) throughout the affected bootstrap-table.blade.php code (Patch Commit, v8.6.2 Release). As an interim workaround prior to patching, restrict the ability to create or modify manufacturer and supplier records to only highly trusted users. Additionally, review existing manufacturer and supplier records for suspicious names containing HTML or JavaScript payloads and remove or sanitize them.