CVE-2026-55469

Snipe-IT: Path traversal vulnerability via CSV import `image` field

CVSS 6.5 MEDIUMEPSS 0.4%CWE-22

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 6.5EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

10 jul 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process. This issue is fixed in version 8.6.2.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Productos afectados

grokability · snipe-it

Referencias

https://github.com/grokability/snipe-it/commit/abc4363e8393b29a5566b8c50144426af72bbc97 https://github.com/grokability/snipe-it/releases/tag/v8.6.2 https://github.com/grokability/snipe-it/security/advisories/GHSA-xr9m-gphc-9p63