CVE-2026-55469

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process. This issue is fixed in version 8.6.2.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/grokability/snipe-it/commit/abc4363e8393b29a5566b8c50144426af72bbc97	Patch
https://github.com/grokability/snipe-it/releases/tag/v8.6.2	Release Notes
https://github.com/grokability/snipe-it/security/advisories/GHSA-xr9m-gphc-9p63	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Snipe-IT es un sistema de gestión de activos/licencias de TI. Antes de la versión 8.6.2, un usuario autenticado con permisos de importación y assets.update puede insertar una cadena de salto de ruta en un campo de imagen de activo a través de la importación CSV y luego activar la eliminación de la imagen, permitiendo la eliminación de archivos arbitrarios accesibles al proceso del servidor. Este problema está solucionado en la versión 8.6.2.

Information

Published : 2026-07-10 20:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-55469

Mitre link : CVE-2026-55469

CVE.ORG link : CVE-2026-55469

JSON object : View

Products Affected

snipeitapp

snipe-it

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-55469", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55469", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-10T20:16:07.254592Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "grokability", "product": "snipe-it", "versions": [{"status": "affected", "version": "< 8.6.2"}]}]}], "published": "2026-07-10T20:16:47.093", "references": [{"url": "https://github.com/grokability/snipe-it/commit/abc4363e8393b29a5566b8c50144426af72bbc97", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/grokability/snipe-it/releases/tag/v8.6.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-xr9m-gphc-9p63", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process. This issue is fixed in version 8.6.2."}, {"lang": "es", "value": "Snipe-IT es un sistema de gesti\u00f3n de activos/licencias de TI. Antes de la versi\u00f3n 8.6.2, un usuario autenticado con permisos de importaci\u00f3n y assets.update puede insertar una cadena de salto de ruta en un campo de imagen de activo a trav\u00e9s de la importaci\u00f3n CSV y luego activar la eliminaci\u00f3n de la imagen, permitiendo la eliminaci\u00f3n de archivos arbitrarios accesibles al proceso del servidor. Este problema est\u00e1 solucionado en la versi\u00f3n 8.6.2."}], "lastModified": "2026-10-25T15:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C0389D5-B8C4-48C1-8E1C-6CCC59B5B631", "versionEndExcluding": "8.6.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}