CVE-2026-55469

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process. This issue is fixed in version 8.6.2.

CVSS 3.1

6.5CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

EPSS

0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-25)

CWE

CWE-22

Published

2026-07-10

Modified

2026-10-25

Record from

the NVD, synced 2026-10-25

Affected

• snipeitapp:snipe-it

References

• https://github.com/grokability/snipe-it/commit/abc4363e8393b29a5566b8c50144426af72bbc97
• https://github.com/grokability/snipe-it/releases/tag/v8.6.2
• https://github.com/grokability/snipe-it/security/advisories/GHSA-xr9m-gphc-9p63

Check your stackJSON