CVE-2026-86748

6.1 Moyenne

Publiée le 09/09/2026 à 16:17 · Modifiée le 14/09/2026 à 22:33 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.9 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	6.1 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H`

Faiblesses (CWE)

CWE-460

Références

https://github.com/grokability/snipe-it/security/advisories/GHSA-4cr5-3hw8-8w5f ExploitVendor AdvisoryMitigationPatch
https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-database-wipe-via-invalid-backup-archive Third Party Advisory
https://github.com/grokability/snipe-it/security/advisories/GHSA-4cr5-3hw8-8w5f ExploitVendor AdvisoryMitigationPatch

CVE-2026-86748

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs