Path Traversal

Snipe-IT is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of asset image paths during CSV import and image deletion, where attacker-controlled path traversal sequences can reference arbitrary files, allowing authenticated users to delete files accessible to the...

Improper Authorization

Snipe-IT is vulnerable to Improper Authorization. The vulnerability is due to insufficient authorization checks on the asset request cancellation endpoint, where user-controlled URL parameters can specify another user's pending request, allowing authenticated attackers to cancel asset requests...

Improper Authorization

Snipe-IT is vulnerable to Improper Authorization. The vulnerability is due to missing authorization checks when deleting pending checkout acceptance records, where the endpoint validates only report viewing permissions and does not verify access to the associated asset, allowing users to delete...

Cross Site Scripting (XSS)

Snipe-IT is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper validation of javascript: URIs in Markdown hyperlinks, where malicious links embedded in custom fields can execute arbitrary JavaScript when clicked by another user viewing the asset details page...

Improper Authorization

Snipe-IT is vulnerable to Improper Authorization. The vulnerability is due to missing authorization checks when adding licenses to predefined kits, where the API validates kit edit permissions but not access to the referenced license, allowing low-privilege users to associate licenses they are no...

Open Redirect

Snipe-IT is vulnerable to Open Redirect. The vulnerability is due to improper trust of the attacker-controlled Referer header, where the previous URL is stored in the session and later used for redirection without validation, allowing attackers to redirect users to malicious websites after a...

Incorrect Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Authorization via the printInventory process. An attacker can access inventory and cost/order metadata from modules that should be restricted by leveraging...

Open Redirect

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Open Redirect via the redirect-intended process. An attacker can redirect users to arbitrary external websites by manipulating the Referer header during the user edit flow...

Cross-site Scripting (XSS)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the headercolor setting in the branding configuration. An attacker with superadmin privileges can inject arbitrary CSS that impacts authenticate...

Incorrect Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Authorization in the Importer API endpoint when a user with CSV import capabilities and a valid API key can overwrite the createdby value of an import file. An...

Authorization Bypass Through User-Controlled Key

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the unaccepted-assets report delete endpoint. An attacker can remove pending checkout acceptance records belonging to...

Directory Traversal

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Directory Traversal via the image field during CSV import. An attacker can delete arbitrary files accessible to the server process by supplying a crafted path traversal stri...

CSV Injection

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to CSV Injection through the postActivityReport process. An attacker can cause arbitrary formula execution in spreadsheet software by injecting a specially crafted User-Agent...

Incorrect Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Authorization due to improper authorization in the legacy license checkin process. An attacker can reclaim license seats assigned to other users or assets by...

Incorrect Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Authorization in the BulkUsersController::destroy process. An attacker can gain unauthorized ability to soft-delete other non-admin users by sending a direct POST...

Cross-site Scripting (XSS)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the markdown-textarea custom field processing. An attacker can execute arbitrary JavaScript in the context of another user by embedding a crafte...

Authorization Bypass Through User-Controlled Key

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the assetid field in the API update process. An attacker can gain unauthorized access to assets outside their company...

Authorization Bypass Through User-Controlled Key

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the POST /api/v1/kits/kitid/licenses endpoint. An attacker can gain unauthorized access to and manipulate license object...

Relative Path Traversal

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Relative Path Traversal via the displaySig process. An attacker can access arbitrary files outside the intended directory by supplying crafted input to the filename paramete...

CVE-2026-55475

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows a user with CSV import capabilities and a valid API key to overwrite the createdby value of an import file, allowing unauthorized modification of import ownership metadata. This issue is fixed in...