CVE-2026-86771 Overview
CVE-2026-86771 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Snipe-IT, an open-source IT asset management platform. The flaw affects all versions before 8.7.0 and stems from missing HTML escaping of the employee_num field in the acceptance PDF generator. An authenticated attacker with users.edit permission can inject an img tag containing an arbitrary HTTP or HTTPS URL. When a victim signs an asset acceptance, the TCPDF writeHTML() function fetches the URL server-side. This enables requests to internal services, cloud metadata endpoints, or external targets from the Snipe-IT server context.
Critical Impact
Authenticated attackers can coerce the Snipe-IT server into making arbitrary outbound HTTP(S) requests, exposing internal network resources and cloud instance metadata.
Affected Products
- Snipe-IT versions prior to 8.7.0
- Deployments using the acceptance PDF generation feature
- Instances with users assigned the users.edit permission
Discovery Timeline
- 2026-09-09 - CVE-2026-86771 published to the National Vulnerability Database
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86771
Vulnerability Analysis
Snipe-IT generates PDF documents when users accept asset assignments. The generator embeds the employee_num field value directly into HTML content passed to TCPDF's writeHTML() function. TCPDF parses img tags and issues HTTP(S) requests to load referenced images into the PDF. Because Snipe-IT does not HTML-escape or sanitize the employee_num value, an attacker can inject arbitrary HTML markup, including img tags referencing attacker-controlled or internal URLs.
Root Cause
The root cause is missing output encoding of user-supplied input before it reaches an HTML renderer. The employee_num field is trusted as plain text but is concatenated into an HTML template. TCPDF interprets any injected tags, transforming a data field into an active HTML context. No URL allowlist or scheme restriction constrains the outbound requests TCPDF issues.
Attack Vector
An attacker with the users.edit permission modifies a user's employee_num value to include an img tag pointing to a target URL. Example payloads reference cloud metadata services such as http://169.254.169.254/latest/meta-data/, internal admin panels, or attacker-controlled logging endpoints. When a victim signs an asset acceptance for that user, the Snipe-IT server renders the PDF and TCPDF issues the request. Response data may be embedded in the generated PDF or observed through side channels, enabling internal reconnaissance and metadata credential theft.
The vulnerability manifests in the acceptance PDF generation path. See the GitHub Security Advisory GHSA-73xg-j94v-gjcf and the Vulncheck Snipe-IT SSRF Advisory for full technical details.
Detection Methods for CVE-2026-86771
Indicators of Compromise
- User records with employee_num values containing HTML tags, particularly <img or src= substrings.
- Outbound HTTP(S) requests from the Snipe-IT server to unexpected internal IP ranges, link-local addresses (169.254.169.254), or unknown external hosts.
- Web server access logs on internal services showing requests originating from the Snipe-IT application server.
- PDF acceptance documents containing broken image placeholders or unexpected embedded content.
Detection Strategies
- Query the Snipe-IT users table for employee_num values matching regex patterns for HTML tags or URL schemes.
- Inspect application logs for TCPDF fetch activity correlated with acceptance signing events.
- Monitor egress traffic from the Snipe-IT server and alert on connections to cloud metadata IPs or RFC 1918 addresses outside expected destinations.
Monitoring Recommendations
- Audit assignment and modification of the users.edit permission and review recent user profile changes.
- Log and review all acceptance signing events and correlate with subsequent outbound server requests.
- Enable network flow monitoring on the Snipe-IT host to baseline expected outbound destinations.
How to Mitigate CVE-2026-86771
Immediate Actions Required
- Upgrade Snipe-IT to version 8.7.0 or later, which HTML-escapes the employee_num field before PDF rendering.
- Audit all user accounts for employee_num values containing HTML markup and remediate any injected payloads.
- Review and restrict the users.edit permission to trusted administrators only.
- Block the Snipe-IT server from reaching cloud metadata endpoints such as 169.254.169.254 at the network layer.
Patch Information
The maintainers addressed CVE-2026-86771 in Snipe-IT 8.7.0 by HTML-escaping the employee_num field before it is passed to TCPDF's writeHTML() function. Upgrade details are available in the GitHub Security Advisory GHSA-73xg-j94v-gjcf.
Workarounds
- Temporarily revoke the users.edit permission from non-administrative accounts until patching is complete.
- Deploy an egress firewall rule that restricts outbound HTTP(S) traffic from the Snipe-IT server to an allowlist of required destinations.
- On AWS deployments, enforce IMDSv2 to require session tokens and mitigate metadata credential theft via SSRF.
- Disable or restrict acceptance PDF generation if the feature is not required in your environment.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.