CVE-2026-86733: Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore
Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (mysql) without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as \! as local shell commands. An authenticated superadministrator who uploads a crafted ZIP backup (POST /admin/backups/upload) and triggers a restore (POST /admin/backups/restore/{filename}) without the optional clean sanitizer parameter — which is not applied by default because DBSANITIZEBYDEFAULT is false — can execute arbitrary OS commands as the web application's operating-system user, exposing application secrets (including database credentials and APPKEY) and allowing modification of application-writable files and data. Version 8.7.0 adds the --binary-mode flag to the client invocation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.7.0 - Compensating control
Limit access to the backup upload and restore endpoints (POST /admin/backups/upload and POST /admin/backups/restore/{filename}) so only trusted administrative users can invoke them.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Snipe-IT superadministrator can exploit it. The attacker must be able to upload a crafted ZIP backup through the backup-upload endpoint and initiate its restoration.
Are default deployments affected?
Yes. The optional clean sanitizer is not applied by default because DB_SANITIZE_BY_DEFAULT is false, so a restore performed without the clean parameter is vulnerable in affected versions.
What access does successful exploitation provide?
Commands run as the operating-system user used by the web application. This can expose application secrets such as database credentials and APP_KEY, and permits modification of application-writable files and data.
What should be done if upgrading is not immediately possible?
Do not restore untrusted backup archives, and ensure restores use the clean sanitizer parameter. Restrict superadministrator access because superadministrators can upload the archive and trigger the restore workflow.
How can I determine whether an instance is affected?
Instances running Snipe-IT before 8.7.0 are affected when backup restoration can be performed without the clean parameter. Version 8.7.0 adds the mysql client --binary-mode flag that prevents the described backslash-command interpretation.