CVE-2026-86749: snipe-it before 8.7.0 Data Loss via Failed Image Write
Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in ImageUploadRequest::handleImages(). Because Laravel's default disk mode does not throw on failure, a silently failed Storage::disk('public')->put(...) call still caused the application to delete the previous image via deleteExistingImage() and to reassign and persist the model's image reference to the new filename, destroying the existing image and leaving the database row pointing at a file that was never written. A mirror problem existed in deleteExistingImage(), where a failed Storage::delete() still nulled the model's image field, orphaning the file on disk. The condition is not directly attacker-controlled: it is triggered when any legitimate authenticated user submits an image upload while the storage backend transiently fails (for example an S3 network error, a local filesystem permission problem, or quota exhaustion). The result is unrecoverable loss of the prior image and a durable inconsistency between the database and disk that requires manual reconciliation. All models whose controllers route through ImageUploadRequest::handleImages (assets, asset models, users, companies, manufacturers, locations, categories, suppliers, departments, and other image-carrying models) are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.7.0 - Operational
For any image records affected on Snipe-IT versions <= 8.6.3, manually reconcile the database image reference with the actual file on disk (the previous image may have been deleted while the new filename was never written due to Storage::put failure).
Event History
Frequently Asked Questions
Which release contains the fix?
The issue is fixed in Snipe-IT 8.7.0. Versions 8.6.3 and earlier are affected.
Is a non-default storage configuration required for this issue to occur?
No. Laravel's default disk mode does not throw an error when a storage write fails, allowing the failed-write path to cause image loss. Failures such as S3 network errors, local filesystem permission problems, or quota exhaustion can trigger it.
Does an attacker control the storage failure needed to trigger the issue?
The storage failure is not directly attacker-controlled. It can occur when a legitimate authenticated user submits an image upload while the storage backend is transiently unavailable or unable to write.
How can administrators recognize that an affected upload or deletion occurred?
After a failed upload, the database can reference a new image filename that was never written while the prior image has been deleted. After a failed deletion, the model image field can be null even though the image file remains on disk; these conditions require manual reconciliation.
Which records may be affected?
All models whose controllers route image handling through ImageUploadRequest::handleImages may be affected, including assets, asset models, and users.