Is CVE-2026-86771 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86771 being exploited in the wild.

How severe is CVE-2026-86771?

High severity, with a CVSS score of 7.6, published 9 September 2026.

Which products and versions are affected?

Snipe-IT Snipe-IT before 8.7.0.

Is there a fix for CVE-2026-86771?

A patch was published on 2026-07-13: Fix committed on develop branch (commit fd7c6b13e9) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86771 attacked?

It is attacked over the network.

Am I affected by CVE-2026-86771?

Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86771: Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num

CVE-2026-86771 · Severity: high · CVSS 7.6 · Published 2026-09-09

Snipe-IT is an open-source IT asset management system used to track and manage computer hardware and software across organizations. The acceptance PDF generator fails to sanitize the employee_num field, allowing users with routine edit permissions to inject malicious image tags that trigger server-side HTTP requests. When an employee signs an asset acceptance document, an attacker could force the server to connect to internal cloud services, steal credentials, or scan internal infrastructure.

Technologies: Snipeitapp Snipe-It. Vendors: Snipeitapp.

Quick answers

Is CVE-2026-86771 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86771 being exploited in the wild.
How severe is CVE-2026-86771?: High severity, with a CVSS score of 7.6, published 9 September 2026.
Which products and versions are affected?: Snipe-IT Snipe-IT before 8.7.0.
Is there a fix for CVE-2026-86771?: A patch was published on 2026-07-13: Fix committed on develop branch (commit fd7c6b13e9) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86771 attacked?: It is attacked over the network.
Am I affected by CVE-2026-86771?: Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Server-Side Request Forgery (CWE-918) achieved via HTML injection (CWE-79) in the CheckoutAcceptance::generateAcceptancePdf() function. The employee_num field is concatenated directly into a TCPDF writeHTML() call without HTML escaping, while all other user-supplied fields in the same function are properly escaped via the e() function. TCPDF's writeHTML() parser supports a subset of HTML including img tags with HTTP(S) URIs, which triggers server-side file fetches. An attacker with users.edit permission (granted to HR and help desk roles) can inject an img tag with an arbitrary URL. The payload is triggered when a victim accepts an asset checkout requiring a signature, causing the Snipe-IT server to issue requests to cloud metadata endpoints, internal services, or external targets. The vulnerability is fixed in commit fd7c6b13e9 and released in version 8.7.0.

Affected products

Snipe-IT Snipe-IT before 8.7.0

Timeline

2026-08-24: disclosed: GitHub Security Advisory GHSA-73xg-j94v-gjcf published
2026-07-13: patched: Fix committed on develop branch (commit fd7c6b13e9)
2026-09-09: advisory: CVE-2026-86771 assigned and publicly disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.