CVE-2026-86749

Snipe-IT versions put... call still caused the application to delete the previous image via deleteExistingImage and to reassign and persist the model's image reference to the new filename, destroying the existing image and leaving the database row pointing at a file that was never written. A mirr...

CVE-2026-86739

Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put when writing the signature PNG and the generated acceptance PDF in Account\AcceptanceController::store. On filesystem drivers that return false instead of throwing on a write failure for example the local disk with restricti...

CVE-2026-86749

Snipe-IT versions up to 8.6.3 contain a data-loss flaw in ImageUploadRequest::handleImages() . The application does not check the return value of Storage::disk('public')->put() or Storage::delete() , so when a storage backend transiently fails (e.g., an S3 network error, filesystem permission ...