CVE-2026-86751: Snipe-IT SSRF Vulnerability via Markdown

CVE-2026-86751 Overview

CVE-2026-86751 affects Snipe-IT asset management software before version 8.7.0. The application fails to sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers submit markdown image syntax in checkout acceptance notes that survives HTML escaping. The CommonMark parser expands the syntax, and laravel-mail-auto-embed resolves the resulting URLs through file_get_contents or curl. This chain allows exfiltration of sensitive files including .env, which contains the Laravel APP_KEY used for cryptographic operations.

Critical Impact

Authenticated attackers can read arbitrary files from the Snipe-IT server, including .env files containing application secrets, and pivot to internal services through server-side request forgery.

Affected Products

• Snipe-IT versions prior to 8.7.0
• Deployments using the CommonMark markdown parser for note fields
• Installations relying on laravel-mail-auto-embed for email image embedding

Discovery Timeline

• 2026-09-09 - CVE-2026-86751 published to the National Vulnerability Database
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86751

Vulnerability Analysis

The flaw resides in how Snipe-IT processes user-submitted notes containing markdown image syntax. When a user accepts a checkout, they can submit an acceptance note that includes markdown constructs such as . The note field passes through HTML escaping, which does not neutralize markdown image directives. The CommonMark parser subsequently converts the markdown into an HTML <img> element with the attacker-controlled URI intact.

When Snipe-IT sends a notification email referencing the note, the laravel-mail-auto-embed library walks the rendered HTML looking for image sources to inline. The library fetches each source with file_get_contents or curl, both of which honor file:// and arbitrary HTTP schemes. The retrieved content is then embedded into the outgoing email as base64 data, delivering the file contents or the SSRF response to a location the attacker can observe.

Root Cause

The issue is classified as [CWE-73]: External Control of File Name or Path. Input sanitization applied HTML escaping without markdown-aware filtering, and the downstream email-embedding library trusted the resulting image URLs as safe local or remote resources.

Attack Vector

An authenticated user with permission to check out assets and submit acceptance notes can trigger the vulnerability. The attacker crafts a note containing a markdown image whose URL points at a local file such as /var/www/html/.env or an internal service reachable from the server. When the acceptance email is generated, the target file is read or the internal request is issued, and the response is embedded into the email delivered to the attacker or another observable recipient. Refer to the GitHub Security Advisory and the Vulncheck Advisory on Snipe-IT for further technical detail.

Detection Methods for CVE-2026-86751

Indicators of Compromise

• Checkout acceptance notes containing markdown image syntax with file://, http://127.0.0.1, or internal IP ranges as the source URL.
• Outbound HTTP requests from the Snipe-IT application server to loopback addresses, cloud metadata endpoints (169.254.169.254), or unexpected internal hosts.
• Web application log entries showing POST requests to checkout acceptance endpoints with ![ sequences in note parameters.
• Unexpected reads of sensitive files such as .env, config/app.php, or SSH key material by the PHP-FPM or web server process.

Detection Strategies

• Inspect the asset_uploads, accepted_assets, and related database tables for note content matching markdown image patterns referencing non-HTTPS or local schemes.
• Alert on process telemetry showing the PHP worker reading paths outside the Snipe-IT application directory, particularly configuration files and secrets.
• Correlate authenticated user activity with subsequent outbound connections from the application host that do not match normal mail delivery destinations.

Monitoring Recommendations

• Enable verbose logging of mail rendering and image-embed operations to capture the URIs fetched by laravel-mail-auto-embed.
• Monitor egress traffic from the Snipe-IT server and baseline expected destinations, flagging deviations for review.
• Review audit logs for accounts submitting checkout acceptance notes at higher-than-normal volume or containing unusual formatting.

How to Mitigate CVE-2026-86751

Immediate Actions Required

• Upgrade Snipe-IT to version 8.7.0 or later, which restricts markdown image handling in note fields.
• Rotate the Laravel APP_KEY, database credentials, mail credentials, and any other secrets present in the .env file, assuming they may have been exposed.
• Audit checkout acceptance notes and mail rendering logs for prior exploitation attempts before applying the patch.
• Restrict egress from the Snipe-IT application server to only required destinations such as the configured SMTP relay.

Patch Information

The vendor released Snipe-IT 8.7.0 to remediate the vulnerability. Upgrade instructions and patch details are published in the GitHub Security Advisory GHSA-f3vq-g24v-xc2g.

Workarounds

• Temporarily disable or restrict the checkout acceptance workflow for untrusted users until the upgrade is deployed.
• Enforce network-level controls that block the application server from reaching loopback, link-local, and internal management ranges.
• Configure the web server or PHP open_basedir to prevent the application from reading sensitive files outside its document root.

# Example egress restriction using iptables to block cloud metadata and loopback abuse
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 ! -o lo -j REJECT