GHSA-xr9m-gphc-9p63: Path Traversal
Impact An authenticated user holding the import and assets.update permissions can delete arbitrary files on the server filesystem by injecting a path traversal string into an asset's image field via CSV import, then triggering the image deletion feature.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have both the `import` and `assets.update` permissions. Users without either permission are not described as able to perform the attack.
What actions are required to trigger file deletion?
The attacker must inject a path traversal value into an asset's `image` field through CSV import, then trigger the image deletion feature. The issue can delete arbitrary files on the server filesystem.
What can be done if patching is not immediately possible?
Restrict the `import` and `assets.update` permissions to trusted users, especially avoiding granting both permissions together. Limit access to CSV import and asset image deletion functions where operationally possible.