CVE-2026-55469

Description

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process. This issue is fixed in version 8.6.2.

Traduire en français

Produits concernés

• grokability snipe-it
• Snipeitapp snipe-it

Scores CVSS

Faiblesses (CWE)

• CWE-22

Références

• https://github.com/grokability/snipe-it/commit/abc4363e8393b29a5566b8c50144426af72bbc97 Patch
• https://github.com/grokability/snipe-it/releases/tag/v8.6.2 Release Notes
• https://github.com/grokability/snipe-it/security/advisories/GHSA-xr9m-gphc-9p63 PatchVendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories