Executive brief
Snipe-IT is an open-source asset management system used to track IT hardware and inventory. The application's signature display feature contains a path traversal vulnerability that allows authenticated users to read arbitrary files from the web server, potentially exposing sensitive configuration files, database credentials, or other confidential data stored on the server.
Technical details
This is a relative path traversal vulnerability (CWE-23) in the displaySig action of Snipe-IT's ActionlogController. The vulnerability occurs because the filename parameter from the HTTP route is concatenated directly into a filesystem path with no sanitization or basename enforcement, allowing an authenticated attacker to traverse outside the private upload directory using sequences like "../". An attacker with valid credentials can exploit this to read arbitrary files accessible to the web server process, leading to confidentiality loss. The fix, applied in version 8.5.0, enforces basename extraction on the filename parameter using PHP's basename() function, preventing directory traversal attacks. This vulnerability requires authentication to exploit but does not require user interaction.
Affected products
- Snipe-IT Snipe-IT < 8.5.0
Timeline
- 2026-06-24: disclosed: Published by GitHub Advisory Database
- 2026-05-12: patched: Patched in version 8.5.0 released May 12, 2026
- 2026-08-28: advisory: GitHub Advisory GHSA-c6f4-wj38-m3g3 published August 28, 2026
References
- https://github.com/grokability/snipe-it/security/advisories/GHSA-c6f4-wj38-m3g3
- https://github.com/grokability/snipe-it/pull/18927
- https://github.com/grokability/snipe-it/commit/cd69a7ea53e030e6e05f08be18daac672c8c4121
- https://github.com/grokability/snipe-it/releases/tag/v8.5.0
- https://api.github.com/repos/grokability/snipe-it/security-advisories/GHSA-c6f4-wj38-m3g3