CVE-2026-86749

Snipe-IT versions up to 8.6.3 contain a data-loss flaw in ImageUploadRequest::handleImages() . The application does not check the return value of Storage::disk('public')->put() or Storage::delete() , so when a storage backend transiently fails (e.g., an S3 network error, filesystem permission ...