VulnerabilityUndergoing Analysis

CVE-2026-86748

Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism.

MEDIUM 6.9EPSS 0.30%

Does this matter?

Lower severity and a low EPSS score (0.30%). Track it; it rarely justifies an emergency change on its own.

Description

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.30% probability · 23th percentile
CISA KEV: Not listed
Weakness: CWE-460
Source: disclosure@vulncheck.com

References

https://github.com/grokability/snipe-it/security/advisories/GHSA-4cr5-3hw8-8w5f
https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-database-wipe-via-invalid-backup-archive
https://github.com/grokability/snipe-it/security/advisories/GHSA-4cr5-3hw8-8w5f

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.