Snipe-IT Flaw Chained: XSS (CVE-2025-59712) to RCE (CVE-2025-59713) Achieves Full Server Compromise, PoC Released

Cybersecurity researchers at Synacktiv have disclosed two critical vulnerabilities in Snipe-IT that can be chained to achieve remote code execution on affected servers, affecting all versions prior to 8.1.18. The flaws, CVE-2025-59712 and CVE-2025-59713, enable a low-privileged user to move from a stored XSS in the User-Agent header to unsafe deserialization in ActionlogsTransformer.php, ultimately compromising the server.

According to Synacktiv’s report, the chain allows an attacker to exfiltrate data via administrator- viewed logs and trigger a backup, obtain the APP_KEY from the .env file, and craft a malicious PHP gadget chain to enable code execution. Synacktiv developed a proof-of-concept that demonstrates the full sequence, including three modes: xss, rce, and fullchain, with PoC scripts available. The flaws were patched in Snipe-IT version 8.1.18, with CVE-2025-59712 fixed in commit 8bc067b and CVE-2025-59713 fixed in commit 8a682be.