CVE-2026-86741: Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA
Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed library resolves server-side and returns as email attachments, exfiltrating sensitive files like .env credentials and enabling SSRF attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
snipe-itto a version that resolves this vulnerability.Fixed in 8.7.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs low-privilege permissions that allow them to modify a category's EULA text field. No user interaction is required after the malicious EULA content is stored; the vulnerable processing occurs when a checkout confirmation email is rendered.
What capabilities does successful exploitation provide?
The attacker can cause the server-side mail auto-embed library to retrieve local files or remote URLs. This can expose sensitive local files, including .env credentials, and can be used to perform SSRF against resources reachable by the Snipe-IT server.
Which installations are affected?
Snipe-IT versions before 8.7.0 are affected. The issue depends on checkout confirmation emails rendering category EULA content and on an attacker having the relevant low-privilege access to edit that field.
What should be prioritized for mitigation?
Upgrade to Snipe-IT 8.7.0 or later. Until upgrading, restrict low-privilege users' ability to edit category EULA text and review existing EULA fields for markdown image syntax or raw HTML img tags that reference local paths or remote URLs.