Snipeitapp Snipe-It vulnerabilities

CVE-2025-63601 [CRITICAL] CWE-434 CVE-2025-63601: Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenti Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system commands.

CVE-2025-15602 [HIGH] CWE-915 CVE-2025-15602: Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges tha Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the

CVE-2026-37709 [CRITICAL] CWE-284 CVE-2026-37709: Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-0 Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute arbitrary code via the app/Http/Controllers/Api/UploadedFilesController.php component

CVE-2026-44832 [HIGH] CWE-281 CVE-2026-44832: Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1. The API controller only strips the superuser key from the permissions array, allowing admin and all other permiss

CVE-2023-5452 [MEDIUM] CWE-79 CVE-2023-5452: Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2. Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2.

CVE-2026-86733 [HIGH] CWE-78 CVE-2026-86733: Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/ Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (`mysql`) without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as `\!` as local shell commands. An authenticated superadministrator who uploads a crafted ZIP backup (POST /admin

CVE-2022-0611 [HIGH] CWE-862 CVE-2022-0611: Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11. Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11.

CVE-2026-86738 [HIGH] CWE-79 CVE-2026-86738: Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url() references to exfiltrate CSRF tokens from other superusers via attribute-selector rules, e

CVE-2026-54329 [HIGH] CWE-862 CVE-2026-54329: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path m Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. Thi

CVE-2022-23064 [HIGH] CWE-74 CVE-2022-23064: In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a spe In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This leads to account take over.

CVE-2026-55516 [HIGH] CWE-639 CVE-2026-55516: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks access to the current maintenance record and asset but then fills attacker-controlled fields including asset_id without re-authorizing the newly supplied asset, allowing an authorized user to move a maintenance record onto an as

CVE-2026-55466 [HIGH] CWE-79 CVE-2026-55466: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG c Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline(), allowing a low-privilege user to upload active XHTML or XML content that is later served same-origin an

CVE-2024-5685 [HIGH] CWE-862 CVE-2024-5685: Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.

CVE-2025-59713 [HIGH] CWE-502 CVE-2025-59713: Snipe-IT before 8.1.18 allows unsafe deserialization. Snipe-IT before 8.1.18 allows unsafe deserialization.

CVE-2026-55474 [MEDIUM] CWE-23 CVE-2026-55474: Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig c Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process. This issue

CVE-2026-55452 [HIGH] CWE-1236 CVE-2026-55452: Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActivityReport() writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged authenticated user to store a formula-like User-Agent that may execute when a report

CVE-2024-51094 [HIGH] CWE-1236 CVE-2024-51094: An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile n An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be executed, allowing the attacker to exfiltrate internal

CVE-2024-48987 [MEDIUM] CWE-1393 CVE-2024-48987: Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an a Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values.

CVE-2026-55469 [MEDIUM] CWE-22 CVE-2026-55469: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process. This issue is fixed in version 8.6.2.

CVE-2024-51093 [HIGH] CWE-79 CVE-2024-51093: Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScript code. This can lead to privilege escalation when the payload is executed, granting the attacker super admin permissions within the Snipe-IT system.