Executive brief
Snipe-IT is an open-source asset management platform that allows administrators to manage and delete file attachments associated with tracked assets. A flaw in the file deletion logic causes delete requests to report success to the user while the physical files remain on disk. This creates a false sense of security for compliance workflows (such as GDPR data deletion requests or purging sensitive contracts) while the data remains accessible via filesystem or backup access.</brief> <parameter name="technical_details">The vulnerability is an improper error-handling issue (CWE-754) in the destroy() methods of both UploadedFilesController and Api\UploadedFilesController. Both methods call Storage::delete() to remove files but discard its return value without checking whether the deletion succeeded, then unconditionally log a successful deletion and return a success response to the user. When the underlying filesystem delete fails (e.g., due to permission issues, read-only filesystem, or cloud storage quota limits), the physical file remains on disk while the UI is updated to hide it based on the deletion log. The attack requires administrative privileges with the manageFiles permission. The fix, released in version 8.7.0, checks the Storage::delete() return value and only logs and confirms the deletion if it succeeded; otherwise, it returns an error response and does not write the deletion log, allowing the file to remain visible to administrators.
Affected products
- Snipe-IT Snipe-IT before 8.7.0
Timeline
- 2026-08-24: disclosed: GitHub Security Advisory published
- 2026-08-24: patched: Fix released in version 8.7.0 (commit 5d36aef)
- 2026-09-09: advisory: CVE-2026-86740 assigned and published to NVD