CVE-2026-55469: Grokability Snipe-IT path traversal in asset image deletion

Executive brief

Snipe-IT is an asset inventory management system. An authenticated user with specific permissions can delete arbitrary files from the server by uploading a crafted CSV file containing path traversal sequences in an asset's image field, then triggering the image deletion feature. This could lead to service disruption or data loss if critical system files are removed.

Technical details

This is a path traversal vulnerability (CWE-22) in Snipe-IT's CSV import feature. An authenticated attacker holding both the `import` and `assets.update` permissions can inject path traversal sequences (e.g., `../../../`) into the `image` field during CSV asset import. When the image deletion feature is subsequently triggered, the application deletes the file referenced by the traversal path without proper validation, allowing an attacker to remove arbitrary files from the server filesystem. The vulnerability affects Snipe-IT versions <= 8.6.1 and has been patched in version 8.6.2. Exploitation requires valid authentication and specific role permissions.

Affected products

• grokability Snipe-IT <= 8.6.1

Timeline

• 2026-06-24: disclosed
• 2026-06-24: patched: Version 8.6.2 released
• 2026-08-28: advisory

References

• https://api.github.com/users/Vasco0x4
• https://github.com/Vasco0x4
• https://api.github.com/users/Vasco0x4/gists%7B/gist_id%7D
• https://api.github.com/users/Vasco0x4/repos
• https://avatars.githubusercontent.com/u/63432221?v=4
• https://api.github.com/users/Vasco0x4/events%7B/privacy%7D