CVE-2026-86741 Overview
CVE-2026-86741 is a high-severity vulnerability in Snipe-IT asset management software versions before 8.7.0. The application fails to sanitize the category End User License Agreement (EULA) text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML <img> tags that reference local files or remote URLs. The mail auto-embed library resolves these references server-side and returns them as email attachments. This behavior enables arbitrary file read of sensitive files such as .env credentials and Server-Side Request Forgery (SSRF) against internal services.
Critical Impact
Authenticated low-privilege attackers can exfiltrate server-side files, including environment secrets, and pivot to internal network resources through SSRF.
Affected Products
- Snipe-IT versions prior to 8.7.0
- Snipe-IT deployments with mail auto-embed functionality enabled
- Instances allowing low-privilege users to edit category EULA text
Discovery Timeline
- 2026-09-09 - CVE-2026-86741 published to the National Vulnerability Database
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86741
Vulnerability Analysis
The vulnerability resides in Snipe-IT's category EULA rendering pipeline. When an asset checkout occurs, the application generates a confirmation email that embeds the category's EULA text without sanitizing markdown image syntax or raw HTML <img> tags. The mail library auto-embeds referenced resources by fetching them server-side and attaching the resolved content to the outgoing message.
Because the fetch executes with the privileges of the Snipe-IT server process, an attacker can reference local filesystem paths or internal HTTP endpoints. The resolved content is then delivered as an email attachment to the checkout recipient, which the attacker can control or observe. This weakness is classified under [CWE-73: External Control of File Name or Path].
Root Cause
The root cause is missing input validation and output sanitization on the category EULA field combined with an unrestricted URL resolver in the mail auto-embed library. The application trusts arbitrary user-supplied markup within a context that performs privileged resource fetching.
Attack Vector
An authenticated attacker with permission to create or edit an asset category injects a payload such as a markdown image reference pointing to file:///var/www/snipe-it/.env or an internal URL like http://169.254.169.254/latest/meta-data/. When any checkout triggers the confirmation email for an asset in that category, the mail library fetches the referenced resource server-side. The retrieved content is returned as an attachment, exfiltrating credentials or enabling SSRF against internal services and cloud metadata endpoints.
The vulnerability manifests through the interaction between the unsanitized EULA field and the auto-embed resolver. See the GitHub Security Advisory and the VulnCheck Advisory on Snipe-IT for technical details.
Detection Methods for CVE-2026-86741
Indicators of Compromise
- Category EULA fields containing <img> tags or markdown image syntax with file://, http://127.0.0.1, http://localhost, or cloud metadata IP addresses such as 169.254.169.254
- Outbound HTTP requests from the Snipe-IT server to internal RFC1918 addresses correlated with checkout events
- Checkout confirmation emails containing unexpected attachments named after server-side file paths
- Audit log entries showing category edits by low-privilege accounts immediately preceding checkout activity
Detection Strategies
- Inspect the categories database table for EULA text containing image tags, markdown image syntax, or protocol handlers such as file:, gopher:, or dict:
- Correlate mail queue events with outbound network connections to identify server-side resource fetching triggered by email rendering
- Review web server access logs for POST requests to category edit endpoints from non-administrative accounts
Monitoring Recommendations
- Alert on any Snipe-IT process making network connections to link-local, loopback, or private address ranges
- Monitor mail attachment sizes and MIME types on checkout confirmation messages for anomalies
- Enable and forward Snipe-IT application logs to a centralized log platform for retention and query
How to Mitigate CVE-2026-86741
Immediate Actions Required
- Upgrade Snipe-IT to version 8.7.0 or later without delay
- Audit all existing category EULA fields for injected image tags or markdown image syntax and remove suspicious entries
- Rotate credentials stored in the Snipe-IT .env file, database, and any secrets accessible to the web server user
- Restrict category management permissions to trusted administrators until patching is complete
Patch Information
Snipe-IT version 8.7.0 addresses CVE-2026-86741 by sanitizing category EULA content before email rendering. Consult the GitHub Security Advisory for the fix commit and upgrade instructions.
Workarounds
- Revoke edit permissions on the categories resource for all non-administrative roles until the upgrade is applied
- Deploy egress filtering to block the Snipe-IT server from reaching link-local, loopback, and cloud metadata endpoints
- Disable or reconfigure the mail auto-embed feature to prevent server-side resolution of remote and local resources
- Enforce outbound HTTP proxy allow-listing for the application server to constrain fetch destinations
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
