Executive brief
Snipe-IT, a popular asset management platform, contains a bug in its image upload feature that silently deletes existing images and corrupts database records when the storage backend temporarily fails (e.g., due to network errors or permission issues). Any authenticated user uploading an image during a storage outage triggers unrecoverable data loss and creates a mismatch between the database and disk that requires manual repair. This affects all asset and user images across the system.
Technical details
The vulnerability is an improper exception handling flaw (CWE-754) in ImageUploadRequest::handleImages() and deleteExistingImage() where Laravel Storage method return values are ignored. When Storage::disk('public')->put() or Storage::delete() silently fail (Laravel's default non-throwing mode), the methods return false but the application logic proceeds unconditionally, deleting the prior image file and updating the database model to reference a file that was never written, or orphaning a file on disk. The flaw is triggered when any authenticated user submits an image upload while the storage backend transiently fails (S3 connectivity issue, filesystem permission error, quota exhaustion). The fix, applied in version 8.7.0, captures the boolean return value of storage operations and only performs cleanup/reassignment on success, falling back to preserve the existing state and log a warning on failure.
Affected products
- Snipe-IT Snipe-IT <=8.6.3
Timeline
- 2026-08-24: disclosed: GitHub Security Advisory GHSA-v37p-hr9x-5w85 published
- 2026-09-09: patched: Fix released in version 8.7.0
- 2026-09-09: advisory: CVE-2026-86749 published