CVE-2026-86751— Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown
Quick assessment
Affected
grokability snipe-it
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Snipe-IT 在 8.7.0 版本之前未能正确过滤笔记字段中的 Markdown 图片语法，使得已认证用户能够读取服务器上的任意文件，并发起服务器端 HTTP 请求。攻击者可以在结账验收备注中提交 Markdown 图片语法，这些语法能够绕过 HTML 转义，随后被 CommonMark 解析器展开，并通过 laravel-mail-auto-embed 插件使用 file_get_contents 或 curl 进行解析，从而泄露包含 APP_KEY 的敏感文件（如 .env）。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86751
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown
Source: CVE Program / CVE List V5
Vulnerability Description
Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded by CommonMark parser, and resolved by laravel-mail-auto-embed via file_get_contents or curl, exfiltrating sensitive files like .env containing APP_KEY.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| grokability | snipe-it | 0 ~ 8.7.0 | - |
|
II. Public POCs for CVE-2026-86751
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86751
请登录查看更多情报信息。
Other References for CVE-2026-86751 (2)
Same Patch Batch · grokability · 2026-09-09 · 36 CVEs total
| CVE-2026-86741 | 8.5 HIGH | Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA |
| CVE-2026-86770 | 8.1 HIGH | Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation |
| CVE-2026-86762 | 8.1 HIGH | Snipe-IT before 8.7.0 Authentication Bypass via API Middleware |
| CVE-2026-86750 | 7.7 HIGH | snipe-it before 8.7.0 Authorization Bypass via API User Create/Update |
| CVE-2026-86771 | 7.6 HIGH | Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num |
| CVE-2026-86754 | 7.3 HIGH | Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients |
| CVE-2026-86759 | 7.1 HIGH | Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer |
| CVE-2026-86757 | 6.5 MEDIUM | Snipe-IT before 8.7.0 Information Disclosure via Custom Fields |
| CVE-2026-86758 | 6.5 MEDIUM | Snipe-IT before 8.7.0 License Key Exposure via CSV Export |
| CVE-2026-86766 | 6.5 MEDIUM | Snipe-IT 8.6.3 Race Condition via Consumable Checkout |
| CVE-2026-86765 | 6.5 MEDIUM | Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint |
| CVE-2026-86742 | 6.5 MEDIUM | Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report |
| CVE-2026-86764 | 6.5 MEDIUM | Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components |
| CVE-2026-86745 | 6.5 MEDIUM | Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export |
| CVE-2026-86746 | 6.4 MEDIUM | Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay |
| CVE-2026-86774 | 6.3 MEDIUM | Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy |
| CVE-2026-86749 | 6.3 MEDIUM | snipe-it before 8.7.0 Data Loss via Failed Image Write |
| CVE-2026-86756 | 6.1 MEDIUM | Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState |
| CVE-2026-86748 | 6.1 MEDIUM | Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive |
| CVE-2026-86752 | 5.4 MEDIUM | snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints |
Showing top 20 of 36 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: snipe-it
-
CVE-2026-86774
Snipe-IT before 8.7.0 Broken Access Control via AssetModelPo -
CVE-2026-86772
Snipe-IT 8.6.3 Stored XSS via Department Names -
CVE-2026-86773
Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoint -
CVE-2026-86771
Snipe-IT before 8.7.0 Server-Side Request Forgery via employ -
CVE-2026-86770
Snipe-IT before 8.7.0 Authentication Bypass via SAML Usernam
Same vendor: grokability
-
CVE-2026-86774
Snipe-IT before 8.7.0 Broken Access Control via AssetModelPo -
CVE-2026-86772
Snipe-IT 8.6.3 Stored XSS via Department Names -
CVE-2026-86773
Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoint -
CVE-2026-86771
Snipe-IT before 8.7.0 Server-Side Request Forgery via employ -
CVE-2026-86770
Snipe-IT before 8.7.0 Authentication Bypass via SAML Usernam
Same weakness: CWE-73
-
CVE-2026-86741
Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Categ -
CVE-2026-79692
Dell SCG 5.0早期版本文件路径控制漏洞 -
CVE-2026-87815
SiYuan before v3.8.2 Path Traversal via removeRiffDeck -
CVE-2026-86995
n8n: Git Node branch.<name>.remote Config Key Bypasses Sandb -
CVE-2026-78620
Improper Path Validation in Okta Access Gateway Kerberos Con
V. Comments for CVE-2026-86751
No comments yet