CVE-2026-86771: Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num
Snipe-IT versions before 8.7.0 fail to HTML-escape the employeenum field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML() function. Attackers can craft a malicious employeenum value containing an img tag with an arbitrary HTTP(S) URL to trigger server-side requests to internal services, cloud metadata endpoints, or external targets when a victim signs an asset acceptance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
snipe-itto a version that resolves this vulnerability.Fixed in 8.7.0 - Compensating control
Restrict access to Snipe-IT users with the users.edit permission so attackers cannot inject a malicious employee_num value that will be rendered in the acceptance PDF.
Event History
Frequently Asked Questions
What access and user interaction are required for exploitation?
An attacker needs the users.edit permission to set a malicious employee_num value. The server-side request is triggered when a victim signs an asset acceptance, causing the acceptance PDF to be generated.
What systems could the affected server be induced to contact?
The injected image URL can point to arbitrary HTTP(S) destinations, including internal services, cloud metadata endpoints, or external targets. The request originates from the Snipe-IT server during PDF generation.
Which deployments should be considered affected?
Snipe-IT versions before 8.7.0 are affected. The provided information does not identify any configuration prerequisite beyond the relevant permission and the asset-acceptance signing workflow.