CVE-2026-55474 | Snipe-IT is an IT asset/license management system. Prior to … | CVSS 7.1 HIGH

Description

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process. This issue is fixed in version 8.5.0.

Metadata

CVE ID: CVE-2026-55474
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-16 22:10 UTC
Published: 2026-07-10 18:29 UTC
Last updated: 2026-07-10 19:12 UTC
Primary CWE: CWE-23
CWE-23: Relative Path Traversal
Vendor / Product: grokability / snipe-it
Sources: cve.org · NVD

Severity & Metrics

7.1 HIGH CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
grokability	snipe-it	—	< 8.5.0

Weakness (CWE)

CWE	Source	Description
CWE-23	cna	CWE-23: Relative Path Traversal

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.1	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References (4)

https://github.com/grokability/snipe-it/security/advisories/GHSA-c6f4-wj38-m3g3 https://github.com/grokability/snipe-it/security/advisories/GHSA-c6f4-wj38-m3g3
https://github.com/grokability/snipe-it/pull/18927 https://github.com/grokability/snipe-it/pull/18927
https://github.com/grokability/snipe-it/commit/cd69a7ea53e030e6e05f08be18daac672c8c4121 https://github.com/grokability/snipe-it/commit/cd69a7ea53e030e6e05f08be18daac672c8c4121
https://github.com/grokability/snipe-it/releases/tag/v8.5.0 https://github.com/grokability/snipe-it/releases/tag/v8.5.0