# CVE-2026-86771: Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num

Source: https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86771 · Severity: high · CVSS 7.6 · Published 2026-09-09

Snipe-IT is an open-source IT asset management system used to track and manage computer hardware and software across organizations. The acceptance PDF generator fails to sanitize the employee_num field, allowing users with routine edit permissions to inject malicious image tags that trigger server-side HTTP requests. When an employee signs an asset acceptance document, an attacker could force the server to connect to internal cloud services, steal credentials, or scan internal infrastructure.

Technologies: [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-86771 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86771 being exploited in the wild.

**How severe is CVE-2026-86771?** High severity, with a CVSS score of 7.6, published 9 September 2026.

**Which products and versions are affected?** Snipe-IT Snipe-IT before 8.7.0.

**Is there a fix for CVE-2026-86771?** A patch was published on 2026-07-13: Fix committed on develop branch (commit fd7c6b13e9) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86771 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86771?** Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Server-Side Request Forgery (CWE-918) achieved via HTML injection (CWE-79) in the CheckoutAcceptance::generateAcceptancePdf() function. The employee_num field is concatenated directly into a TCPDF writeHTML() call without HTML escaping, while all other user-supplied fields in the same function are properly escaped via the e() function. TCPDF's writeHTML() parser supports a subset of HTML including img tags with HTTP(S) URIs, which triggers server-side file fetches. An attacker with users.edit permission (granted to HR and help desk roles) can inject an img tag with an arbitrary URL. The payload is triggered when a victim accepts an asset checkout requiring a signature, causing the Snipe-IT server to issue requests to cloud metadata endpoints, internal services, or external targets. The vulnerability is fixed in commit fd7c6b13e9 and released in version 8.7.0.

## Affected products

- Snipe-IT Snipe-IT before 8.7.0

## Timeline

- 2026-08-24: disclosed: GitHub Security Advisory GHSA-73xg-j94v-gjcf published
- 2026-07-13: patched: Fix committed on develop branch (commit fd7c6b13e9)
- 2026-09-09: advisory: CVE-2026-86771 assigned and publicly disclosed

## References

- [https://github.com/grokability/snipe-it/security/advisories/GHSA-73xg-j94v-gjcf](https://github.com/grokability/snipe-it/security/advisories/GHSA-73xg-j94v-gjcf)
- [https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-server-side-request-forgery-via-employee-num](https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-server-side-request-forgery-via-employee-num)

## Related threats

- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)
- [Snipe-IT stored cross-site scripting in department names](https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names)
- [Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation)
- [Snipe-IT improper ownership management in consumables checkout API](https://junglewise.ai/threats/cve-2026-86769-snipe-it-improper-ownership-management-in-consumables-checkout)