CVE-2026-55469

Description

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process. This issue is fixed in version 8.6.2.

PUBLISHED Reserved 2026-06-16 | Published 2026-07-10 | Updated 2026-07-10 | Assigner GitHub_M

Problem types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

References

github.com/...ipe-it/security/advisories/GHSA-xr9m-gphc-9p63

github.com/...ommit/abc4363e8393b29a5566b8c50144426af72bbc97

github.com/grokability/snipe-it/releases/tag/v8.6.2

cve.org (CVE-2026-55469)

nvd.nist.gov (CVE-2026-55469)

Download JSON