[HIGH] Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

PKSA-yjnz-vzp8-t7f6 CVE-2026-63498 GHSA-396x-xmvh-p563

Affected package: snipe/snipe-it

Affected version: <8.7.0

Reported by:
GitHub