CVE-2026-86751: Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown
Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded by CommonMark parser, and resolved by laravel-mail-auto-embed via filegetcontents or curl, exfiltrating sensitive files like .env containing APPKEY.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.7.0 - Compensating control
Until upgraded, restrict network egress from the Snipe-IT server (e.g., block outbound HTTP/S) to reduce SSRF impact from malicious markdown image syntax.
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated user who can submit checkout acceptance notes can trigger the vulnerable Markdown image handling. No additional user interaction is required.
What access does an attacker need, and what can they obtain?
The attacker needs low-privileged authenticated access and the ability to place Markdown image syntax in a checkout acceptance note. Successful exploitation can cause the server to read local files or make server-side HTTP requests, potentially exposing sensitive data such as a .env file containing APP_KEY.
Are installations on version 8.7.0 affected?
The affected versions are Snipe-IT releases before 8.7.0. The provided information does not identify any other configuration requirement beyond the ability to submit checkout acceptance notes.