CVE-2026-86741: Snipe-IT arbitrary file read and SSRF via category EULA

CVE-2026-86741 · Severity: high · CVSS 8.5 · Published 2026-09-09

Snipe-IT is an open-source IT asset management platform used to track hardware, licenses, and inventory. The application fails to sanitize category EULA text before including it in checkout confirmation emails, allowing authenticated users with basic permissions to read arbitrary files from the server (including sensitive configuration files and credentials) and perform server-side request forgery attacks against internal systems.

Technologies: Snipeitapp Snipe-It. Vendors: Snipeitapp.

Quick answers

Is CVE-2026-86741 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-86741 being exploited in the wild.
How severe is CVE-2026-86741?
High severity, with a CVSS score of 8.5, published 9 September 2026.
Which products and versions are affected?
Grokability Snipe-IT before 8.7.0.
Is there a fix for CVE-2026-86741?
A patch was published on 2026-09-09: Patch available in version 8.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86741 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-86741?
Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an unsanitized input leading to arbitrary file read and SSRF in the mail rendering pipeline. The SnipeModel::getEula() method returns raw EULA text without sanitization, which is then passed to mail templates rendered as Markdown. The eduardokum/laravel-mail-auto-embed library walks the generated HTML and resolves all img tags server-side using file_get_contents() for local paths and curl for remote URLs (without certificate verification or private IP filtering), then inlines the response as MIME attachments. An authenticated attacker with basic IT clerk permissions (categories.create/edit, models.create, assets.create, assets.checkout) can inject markdown image syntax or HTML img tags pointing to local files (e.g., /var/www/html/.env containing database credentials and APP_KEY) or remote URLs, triggering exfiltration via the checkout confirmation email. The attack is non-blind: full file contents are returned as attachments. Patched in version 8.7.0; the fix registers BlockImagesMarkdownExtension on the mail CommonMark parser to neutralize markdown syntax while additionally sanitizing raw HTML img tags.

Affected products

  • Grokability Snipe-IT before 8.7.0

Timeline

  • 2026-08-24: disclosed: GitHub Security Advisory GHSA-qmhc-p47c-6x75 published
  • 2026-09-09: advisory: NVD and public advisories published, CVE-2026-86741 assigned
  • 2026-09-09: patched: Patch available in version 8.7.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.