VulnerabilityAnalyzed

CVE-2026-55469

Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server…

MEDIUM 6.5EPSS 0.59%

Does this matter?

Lower severity and a low EPSS score (0.59%). Track it; it rarely justifies an emergency change on its own.

Description

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process. This issue is fixed in version 8.6.2.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
EPSS: 0.59% probability · 46th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: snipeitapp/snipe-it
Source: security-advisories@github.com

References

https://github.com/grokability/snipe-it/commit/abc4363e8393b29a5566b8c50144426af72bbc97Patch
https://github.com/grokability/snipe-it/releases/tag/v8.6.2Release Notes
https://github.com/grokability/snipe-it/security/advisories/GHSA-xr9m-gphc-9p63Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.