CVE-2026-55474: Snipe-IT Path Traversal Vulnerability

CVE-2026-55474 Overview

CVE-2026-55474 is a path traversal vulnerability [CWE-23] in Snipe-IT, an open-source IT asset and license management system maintained by Grokability. The flaw exists in the ActionlogController::displaySig method, which concatenates a user-supplied filename route parameter into a private upload directory path without sanitization. An authenticated attacker can traverse outside the intended directory and read arbitrary files accessible to the web server process. The vulnerability affects all Snipe-IT releases prior to version 8.5.0.

Critical Impact
Authenticated attackers can read arbitrary files readable by the web server process, exposing configuration files, credentials, and sensitive application data.

Affected Products

Snipe-IT versions prior to 8.5.0
ActionlogController::displaySig signature display endpoint
Related upload handling in AcceptanceController for acceptance PDF logos

Discovery Timeline

2026-07-10 - CVE-2026-55474 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-55474

Vulnerability Analysis

The vulnerability resides in app/Http/Controllers/ActionlogController.php, specifically in the displaySig($filename) method that serves signature images from Snipe-IT's private upload directory. The method used the $filename parameter directly in path construction without validating or normalizing traversal sequences such as ../.

A related unsafe pattern appears in app/Http/Controllers/Account/AcceptanceController.php, where $settings->acceptance_pdf_logo was concatenated into public_path().'/uploads/' and passed to file_get_contents without extracting the basename. An authenticated attacker with the ability to influence these filename inputs can escape the intended directory and read any file the PHP process can access, including .env files, database configuration, and stored secrets.

Root Cause

The root cause is missing input sanitization on file path components. Snipe-IT trusted route parameters and stored settings values as safe path segments. Neither basename() normalization nor an allowlist check was applied before the path was passed to file-reading functions.

Attack Vector

Exploitation requires an authenticated session but no elevated privileges or user interaction. The attacker crafts an HTTP request to the signature display route with a filename containing directory traversal sequences. The web application resolves the path relative to the uploads directory and returns the contents of the target file.

php

// Patch in app/Http/Controllers/ActionlogController.php
public function displaySig($filename): RedirectResponse|Response|bool
{
    $filename = basename((string) $filename);

    // PHP doesn't let you handle file not found errors well with
    // file_get_contents, so we set the error reporting for just this class
    error_reporting(0);

Source: grokability/snipe-it commit cd69a7e

php

// Patch in app/Http/Controllers/Account/AcceptanceController.php
if (($settings->acceptance_pdf_logo) && (Storage::disk('public')->exists($settings->acceptance_pdf_logo))) {
    $encoded_logo = base64_encode(file_get_contents(public_path().'/uploads/'.basename($settings->acceptance_pdf_logo)));
}

Source: grokability/snipe-it commit cd69a7e. The fix enforces basename() on filename inputs so only the final path component is retained, neutralizing ../ sequences.

Detection Methods for CVE-2026-55474

Indicators of Compromise

HTTP requests to the Snipe-IT signature display route containing ../, %2e%2e%2f, or other encoded traversal sequences in the filename segment
Access log entries showing signature endpoints returning non-image content types or unusually small or large response bodies
Web server reads of sensitive files such as .env, config/database.php, or storage/logs/laravel.log triggered by the PHP-FPM or Apache worker process

Detection Strategies

Inspect Snipe-IT and reverse proxy access logs for requests to signature routes with filenames that contain path separators or percent-encoded traversal patterns
Correlate authenticated user sessions with anomalous file access patterns from the web server user on the underlying host
Deploy web application firewall (WAF) rules to flag directory traversal payloads targeting Snipe-IT filename parameters

Monitoring Recommendations

Enable file integrity and access monitoring on sensitive Laravel files including .env and config/ directories
Alert on outbound transfers of large text payloads immediately following authenticated Snipe-IT sessions
Track failed and successful reads by the web server process outside the storage/private_uploads/ tree

How to Mitigate CVE-2026-55474

Immediate Actions Required

Upgrade Snipe-IT to version 8.5.0 or later, which enforces basename() on filename inputs
Rotate any credentials, API keys, and secrets stored in .env or configuration files on affected hosts, since prior reads cannot be reliably audited
Review authentication logs for suspicious account activity that predated the upgrade

Patch Information

The fix is included in the Snipe-IT v8.5.0 release via pull request #18927 and commit cd69a7e. Full technical detail is available in GitHub Security Advisory GHSA-c6f4-wj38-m3g3.

Workarounds

Restrict Snipe-IT access to trusted networks or place it behind an authenticated reverse proxy until the patch is applied
Add a WAF rule blocking requests to signature and acceptance routes when filename parameters contain .., /, or percent-encoded traversal sequences
Reduce the file system privileges of the web server user so it cannot read sensitive configuration files outside the application's data directories

bash

# Example nginx rule to block traversal patterns on Snipe-IT signature routes
location ~ ^/account/accept/signature/ {
    if ($request_uri ~* "(\.\./|%2e%2e%2f|%2e%2e/|\.\.%2f)") {
        return 403;
    }
    try_files $uri /index.php?$query_string;
}