CVE-2026-55474: Snipe-IT: Directory traversal in displaySig
Impact The displaySig action in ActionlogController serves signature image files from a private upload directory. The filename parameter from the HTTP route is concatenated directly into a filesystem path with no sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process.
Reported by https://github.com/securin-public
Other sources
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process. This issue is fixed in version 8.5.0.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.5.0 - Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55474?
CVE-2026-55474 has a risk score of 47, indicating a moderate severity level.
How do I fix CVE-2026-55474?
To fix CVE-2026-55474, upgrade Snipe-IT to version 8.5.0 or later.
What systems are affected by CVE-2026-55474?
CVE-2026-55474 affects all versions of Snipe-IT prior to 8.5.0.
What type of vulnerability is CVE-2026-55474?
CVE-2026-55474 is a directory traversal vulnerability in the Snipe-IT ActionlogController.
Who can exploit CVE-2026-55474?
An authenticated attacker can exploit CVE-2026-55474 to read arbitrary files by traversing outside the intended upload directory.