CVE-2026-55469

MEDIUM

Snipe-IT: Path traversal vulnerability via CSV import `image` field

Title source: cna
STIX 2.1

Description

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process. This issue is fixed in version 8.6.2.

References (3)

Core 3

Scores

CVSS v3 6.5
EPSS 0.0038
EPSS Percentile 30.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (2)
grokability/snipe-it < 8.6.2
snipeitapp/snipe-it < 8.6.2
Published Jul 10, 2026
Tracked Since Jul 11, 2026