CVE-2026-55469: Snipe-IT Path Traversal Vulnerability

CVE-2026-55469 Overview

CVE-2026-55469 is a path traversal vulnerability [CWE-22] in Snipe-IT, an open-source IT asset and license management system maintained by Grokability. The flaw affects all versions prior to 8.6.2. An authenticated user with import and assets.update permissions can inject a path traversal sequence into an asset image field via CSV import. Triggering the image deletion routine then removes arbitrary files accessible to the web server process.

Critical Impact
Attackers with import privileges can delete arbitrary files on the host filesystem, including application configuration, logs, and data files, leading to integrity loss and denial of service.

Affected Products

Snipe-IT versions prior to 8.6.2
Deployments exposing asset CSV import to authenticated users
Self-hosted snipeitapp/snipe-it installations

Discovery Timeline

2026-07-10 - CVE-2026-55469 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-55469

Vulnerability Analysis

The vulnerability resides in Snipe-IT's asset CSV import workflow. The AssetImporter class reads the image column from user-supplied CSV rows and stores the raw value in $this->item['image'] without sanitization. That value is later concatenated with the fixed upload path public_path().'/uploads/assets/' and passed to PHP's unlink() when a user submits an asset update with image_delete set.

Because the image value is trusted as a filename, a value such as ../../.env traverses out of the uploads/assets/ directory. The unlink() call then removes any file readable and writable by the PHP process. This is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Root Cause

Input from the CSV column was persisted directly to the asset record without a basename() normalization step. The deletion code likewise trusted the stored path, allowing traversal characters to reach the filesystem call.

Attack Vector

Exploitation requires an authenticated account holding both import and assets.update permissions. The attacker imports a CSV that sets an asset's image field to a traversal string, then submits an update on that asset with the image_delete flag. The vulnerability is reachable over the network and requires no user interaction beyond the attacker's own actions.

php

// Patch: app/Importer/AssetImporter.php
$this->item['notes'] = trim($this->findCsvMatch($row, 'asset_notes'));
-$this->item['image'] = trim($this->findCsvMatch($row, 'image'));
+$this->item['image'] = basename(trim($this->findCsvMatch($row, 'image')));

// Patch: app/Http/Controllers/Assets/AssetsController.php
if ($request->filled('image_delete')) {
    try {
-       unlink(public_path().'/uploads/assets/'.$asset->image);
+       unlink(public_path().'/uploads/assets/'.basename($asset->image));
        $asset->image = '';
    } catch (\Exception $e) {
        Log::info($e);
    }
}

Source: Snipe-IT commit abc4363. The fix wraps both the import assignment and the deletion path in basename(), stripping any directory components before the filename reaches unlink().

Detection Methods for CVE-2026-55469

Indicators of Compromise

CSV import records where the image column contains ../, ..\, absolute paths, or non-standard filenames.
Unexpected unlink() errors or missing files under the Snipe-IT application directory, such as .env, storage/logs/*.log, or database files.
Snipe-IT audit log entries showing asset updates with image_delete shortly after a CSV import event.

Detection Strategies

Review Snipe-IT activity_log entries filtered by action_type = 'update' on assets whose image field contains directory separators.
Correlate web access logs for POST requests to /hardware/import followed by asset edit requests including the image_delete parameter from the same user session.
Enable PHP open_basedir restrictions and monitor PHP Warning: unlink() messages that indicate traversal attempts blocked by filesystem policy.

Monitoring Recommendations

Alert on filesystem deletions of sensitive Snipe-IT files including .env, config/*.php, and storage/ contents by the web server user.
Track authenticated users granted both import and assets.update permissions and validate whether elevated privileges are still required.
Baseline the contents of public/uploads/assets/ and flag deletions referencing paths outside that directory.

How to Mitigate CVE-2026-55469

Immediate Actions Required

Upgrade Snipe-IT to version 8.6.2 or later, which normalizes image filenames with basename() before deletion.
Audit user accounts holding import and assets.update permissions and revoke access that is not operationally required.
Restore any files that may have been deleted from validated backups and rotate secrets stored in .env if that file was accessible.

Patch Information

The fix is included in Snipe-IT v8.6.2 and tracked as advisory GHSA-xr9m-gphc-9p63. Details are available in the GitHub Security Advisory GHSA-xr9m-gphc-9p63 and the GitHub Release v8.6.2. The corrective commit is abc4363.

Workarounds

Restrict the import permission to a small set of trusted administrators until the patch is applied.
Configure PHP open_basedir to confine the Snipe-IT process to its application root and upload directories.
Run the Snipe-IT PHP process under a low-privilege OS user that cannot read or delete sensitive configuration files outside the web root.

bash

# Upgrade Snipe-IT to the patched release
cd /var/www/snipe-it
sudo -u www-data git fetch --tags
sudo -u www-data git checkout v8.6.2
sudo -u www-data composer install --no-dev --prefer-source
sudo -u www-data php artisan migrate --force
sudo -u www-data php artisan config:clear