CVE-2026-86741— Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA
Quick assessment
Affected
grokability snipe-it
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Snipe-IT 版本 8.7.0 之前的版本在将资产类别的用户许可协议（EULA）文本渲染到结账确认邮件时，未对其进行过滤。拥有低权限的攻击者可以注入指向本地文件或远程 URL 的 Markdown 图片语法或原始 HTML img 标签，邮件自动嵌入库会在服务器端解析这些标签并将结果作为邮件附件返回，从而泄露如 .env 凭证文件等敏感信息，并允许发起 SSRF（服务器端请求伪造）攻击。
Possible ATT&CK Techniques 3 AI
T1059 · Command and Scripting Interpreter T1082 · System Information Discovery T1083 · File and Directory Discovery
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86741
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA
Source: CVE Program / CVE List V5
Vulnerability Description
Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed library resolves server-side and returns as email attachments, exfiltrating sensitive files like .env credentials and enabling SSRF attacks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| grokability | snipe-it | 0 ~ 8.7.0 | - |
|
II. Public POCs for CVE-2026-86741
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86741
请登录查看更多情报信息。
Other References for CVE-2026-86741 (2)
Same Patch Batch · grokability · 2026-09-09 · 36 CVEs total
| CVE-2026-86751 | 8.5 HIGH | Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown |
| CVE-2026-86762 | 8.1 HIGH | Snipe-IT before 8.7.0 Authentication Bypass via API Middleware |
| CVE-2026-86770 | 8.1 HIGH | Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation |
| CVE-2026-86750 | 7.7 HIGH | snipe-it before 8.7.0 Authorization Bypass via API User Create/Update |
| CVE-2026-86771 | 7.6 HIGH | Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num |
| CVE-2026-86754 | 7.3 HIGH | Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients |
| CVE-2026-86759 | 7.1 HIGH | Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer |
| CVE-2026-86766 | 6.5 MEDIUM | Snipe-IT 8.6.3 Race Condition via Consumable Checkout |
| CVE-2026-86757 | 6.5 MEDIUM | Snipe-IT before 8.7.0 Information Disclosure via Custom Fields |
| CVE-2026-86764 | 6.5 MEDIUM | Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components |
| CVE-2026-86758 | 6.5 MEDIUM | Snipe-IT before 8.7.0 License Key Exposure via CSV Export |
| CVE-2026-86765 | 6.5 MEDIUM | Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint |
| CVE-2026-86742 | 6.5 MEDIUM | Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report |
| CVE-2026-86745 | 6.5 MEDIUM | Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export |
| CVE-2026-86746 | 6.4 MEDIUM | Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay |
| CVE-2026-86774 | 6.3 MEDIUM | Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy |
| CVE-2026-86749 | 6.3 MEDIUM | snipe-it before 8.7.0 Data Loss via Failed Image Write |
| CVE-2026-86756 | 6.1 MEDIUM | Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState |
| CVE-2026-86748 | 6.1 MEDIUM | Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive |
| CVE-2026-86768 | 5.4 MEDIUM | Snipe-IT before 8.7.0 Improper Input Validation via API Checkout |
Showing top 20 of 36 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: snipe-it
-
CVE-2026-86774
Snipe-IT before 8.7.0 Broken Access Control via AssetModelPo -
CVE-2026-86772
Snipe-IT 8.6.3 Stored XSS via Department Names -
CVE-2026-86773
Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoint -
CVE-2026-86771
Snipe-IT before 8.7.0 Server-Side Request Forgery via employ -
CVE-2026-86770
Snipe-IT before 8.7.0 Authentication Bypass via SAML Usernam
Same vendor: grokability
-
CVE-2026-86774
Snipe-IT before 8.7.0 Broken Access Control via AssetModelPo -
CVE-2026-86772
Snipe-IT 8.6.3 Stored XSS via Department Names -
CVE-2026-86773
Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoint -
CVE-2026-86771
Snipe-IT before 8.7.0 Server-Side Request Forgery via employ -
CVE-2026-86770
Snipe-IT before 8.7.0 Authentication Bypass via SAML Usernam
Same weakness: CWE-73
-
CVE-2026-86751
Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markd -
CVE-2026-79692
Dell SCG 5.0早期版本文件路径控制漏洞 -
CVE-2026-87815
SiYuan before v3.8.2 Path Traversal via removeRiffDeck -
CVE-2026-86995
n8n: Git Node branch.<name>.remote Config Key Bypasses Sandb -
CVE-2026-78620
Improper Path Validation in Okta Access Gateway Kerberos Con
V. Comments for CVE-2026-86741
No comments yet