CVE-2026-86771— Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num
Quick assessment
Affected
grokability snipe-it
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Snipe-IT 版本 8.7.0 之前未能对资产验收 PDF 生成器中的 字段进行 HTML 转义，这使得拥有 权限的攻击者能够在 TCPDF 的 函数中注入 标签。攻击者可以构造包含任意 HTTP(S) URL 的 标签作为恶意的 值，从而在受害者签署资产验收文件时，触发服务器端向内部服务、云元数据端点或外部目标发起请求。
Possible ATT&CK Techniques 3 AI
T1019 T1571 · Non-Standard Port T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86771
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num
Source: CVE Program / CVE List V5
Vulnerability Description
Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML() function. Attackers can craft a malicious employee_num value containing an img tag with an arbitrary HTTP(S) URL to trigger server-side requests to internal services, cloud metadata endpoints, or external targets when a victim signs an asset acceptance.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| grokability | snipe-it | 8.6.3 ~ 8.7.0 | - |
|
II. Public POCs for CVE-2026-86771
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86771
请登录查看更多情报信息。
Other References for CVE-2026-86771 (2)
Same Patch Batch · grokability · 2026-09-09 · 36 CVEs total
| CVE-2026-86741 | 8.5 HIGH | Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA |
| CVE-2026-86751 | 8.5 HIGH | Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown |
| CVE-2026-86770 | 8.1 HIGH | Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation |
| CVE-2026-86762 | 8.1 HIGH | Snipe-IT before 8.7.0 Authentication Bypass via API Middleware |
| CVE-2026-86750 | 7.7 HIGH | snipe-it before 8.7.0 Authorization Bypass via API User Create/Update |
| CVE-2026-86754 | 7.3 HIGH | Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients |
| CVE-2026-86759 | 7.1 HIGH | Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer |
| CVE-2026-86757 | 6.5 MEDIUM | Snipe-IT before 8.7.0 Information Disclosure via Custom Fields |
| CVE-2026-86758 | 6.5 MEDIUM | Snipe-IT before 8.7.0 License Key Exposure via CSV Export |
| CVE-2026-86766 | 6.5 MEDIUM | Snipe-IT 8.6.3 Race Condition via Consumable Checkout |
| CVE-2026-86765 | 6.5 MEDIUM | Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint |
| CVE-2026-86742 | 6.5 MEDIUM | Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report |
| CVE-2026-86764 | 6.5 MEDIUM | Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components |
| CVE-2026-86745 | 6.5 MEDIUM | Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export |
| CVE-2026-86746 | 6.4 MEDIUM | Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay |
| CVE-2026-86774 | 6.3 MEDIUM | Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy |
| CVE-2026-86749 | 6.3 MEDIUM | snipe-it before 8.7.0 Data Loss via Failed Image Write |
| CVE-2026-86756 | 6.1 MEDIUM | Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState |
| CVE-2026-86748 | 6.1 MEDIUM | Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive |
| CVE-2026-86752 | 5.4 MEDIUM | snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints |
Showing top 20 of 36 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: snipe-it
-
CVE-2026-86774
Snipe-IT before 8.7.0 Broken Access Control via AssetModelPo -
CVE-2026-86772
Snipe-IT 8.6.3 Stored XSS via Department Names -
CVE-2026-86773
Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoint -
CVE-2026-86770
Snipe-IT before 8.7.0 Authentication Bypass via SAML Usernam -
CVE-2026-86769
Snipe-IT before 8.7.0 Audit Log Misattribution via Consumabl
Same vendor: grokability
-
CVE-2026-86774
Snipe-IT before 8.7.0 Broken Access Control via AssetModelPo -
CVE-2026-86772
Snipe-IT 8.6.3 Stored XSS via Department Names -
CVE-2026-86773
Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoint -
CVE-2026-86770
Snipe-IT before 8.7.0 Authentication Bypass via SAML Usernam -
CVE-2026-86769
Snipe-IT before 8.7.0 Audit Log Misattribution via Consumabl
Same weakness: CWE-918
-
CVE-2026-87821
Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forge -
CVE-2026-79635
Dell SCG 5.0 多版本SSRF漏洞 -
CVE-2026-57866
Apache Impala: Secrets Exfiltration via SSRF -
CVE-2026-54048
Apache Impala: Avro Schema URL Server-Side Request Forgery -
CVE-2026-19733
SSRF in Yordam Informatics's Library Automation System
V. Comments for CVE-2026-86771
No comments yet