B1Gn0Se

The SVG exporter improperly handles the fill-color value of a text object, inserting it into a `ppmcolormask` command string that is then executed via `child process.exec`. An attacker with file editing permissions or one who provides a malicious file via a public share link can inject shell metacharacters into the fill color to execute arbitrary commands with the privileges of the exporter service.

An authenticated user with file-management access can upload malicious XML and XSLT (Extensible Stylesheet Language Transformations) attachments. The API endpoint 'GET /api/v1/{object type}/{id}/files/{file id}' fails to apply a safe-inline allowlist when the `inline` parameter is set to `true`. This allows the browser to process an attacker-controlled xml-stylesheet reference, leading to the execution of arbitrary JavaScript within the Snipe-IT origin. If an authorized victim opens the attachment URL, the script can read same-origin data and perform authenticated actions using the victim's privileges, potentially leading to administrative account compromise and exposure of sensitive asset, user, and license information.

An unauthenticated attacker can bypass authentication hooks and break prefix encapsulation by sending a malformed URL. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, which ignores the prefix and skips the normal lifecycle of the selected handler. This allows a request sent under one plugin prefix to be routed to the custom not-found handler of a different sibling plugin, potentially allowing the attacker to reach an authentication-protected private fallback and read its full response.

An issue exists where the software fails to honor the `createUserDir` isolation during proxy and hook authentication auto-provisioning paths. This allows attackers possessing valid upstream-authenticated credentials to exploit the server root scope assignment to read, modify, delete, and share files belonging to other users.

A path traversal issue exists in the Kubernetes Ingress NGINX provider's RewriteTarget middleware, which is generated from the `nginx.ingress.kubernetes.io/rewrite-target` annotation. When an Ingress path utilizes a regex that captures attacker-controlled text without requiring a path separator, a crafted request can be rewritten to a dot-segment traversal path. Because the system forwards the request without post-replacement normalization validation, a backend that normalizes dot segments may resolve the path to a protected endpoint. This allows an attacker to bypass route-level authentication mechanisms such as BasicAuth, DigestAuth, or ForwardAuth.