CVE-2026-86741

Analyzed Analyzed - Analysis Complete

Stored XSS in Snipe-IT via Unsanitized EULA Text

Publication date: 2026-09-09

Last updated on: 2026-09-14

Assigner: VulnCheck

Description

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed library resolves server-side and returns as email attachments, exfiltrating sensitive files like .env credentials and enabling SSRF attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-14

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86741

EUVD

EUVD-2026-74918

Affected Vendors & Products

Vendor	Product	Version / Range
snipeitapp	snipe-it	to 8.7.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

This vulnerability affects Snipe-IT versions before 8.7.0 due to improper sanitization of the category EULA text field. Attackers with low privileges can inject markdown or HTML image tags that reference local files or remote URLs. When emails are generated, the mail library processes these tags server-side, attaching referenced files to emails, potentially exposing sensitive data like .env credentials and enabling SSRF attacks.

Detection Guidance

Check Snipe-IT version with: grep -r "version" /path/to/snipe-it/config/app.php. If version is below 8.7.0, the system is vulnerable. Inspect email templates for unfiltered EULA text fields in category settings. Monitor outgoing emails for unexpected attachments or SSRF indicators like remote URL fetches.

Impact Analysis

An attacker can read arbitrary local files, including sensitive files like .env credentials, and perform SSRF attacks. Exfiltration occurs automatically via email when assets are checked out, requiring no user interaction. Compromised credentials may lead to session forgery or remote code execution if the APP_KEY is exposed.

Compliance Impact

This vulnerability can lead to exposure of sensitive data such as credentials and configuration files, violating GDPR and HIPAA requirements for data protection and confidentiality. Unauthorized access to personal or health information may result in compliance breaches and legal consequences.

Mitigation Strategies

Upgrade Snipe-IT to version 8.7.0 or later immediately. If upgrading is not possible, apply the patch from GitHub Advisory GHSA-qmhc-p47c-6x75. Restrict low-privilege user permissions to prevent category EULA modifications. Review recent emails for suspicious attachments or exfiltrated data.

Hi! I’m here to help you understand CVE-2026-86741. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70