CVE-2026-55469 | Snipe-IT is an IT asset/license management system. Prior to … | CVSS 6.5 MEDIUM

Description

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process. This issue is fixed in version 8.6.2.

Metadata

CVE ID: CVE-2026-55469
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-16 22:10 UTC
Published: 2026-07-10 19:42 UTC
Last updated: 2026-07-10 20:16 UTC
Primary CWE: CWE-22
CWE-22: Improper Limitation of a Pathname to a Restricted Di…
Vendor / Product: grokability / snipe-it
Sources: cve.org · NVD

Severity & Metrics

6.5 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
grokability	snipe-it	—	< 8.6.2

Weakness (CWE)

CWE	Source	Description
CWE-22	cna	CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.5	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

References (3)

https://github.com/grokability/snipe-it/security/advisories/GHSA-xr9m-gphc-9p63 https://github.com/grokability/snipe-it/security/advisories/GHSA-xr9m-gphc-9p63
https://github.com/grokability/snipe-it/commit/abc4363e8393b29a5566b8c50144426af72bbc97 https://github.com/grokability/snipe-it/commit/abc4363e8393b29a5566b8c50144426af72bbc97
https://github.com/grokability/snipe-it/releases/tag/v8.6.2 https://github.com/grokability/snipe-it/releases/tag/v8.6.2