LOWEPSS 0.6%

CVE-2026-55469

Snipe-IT has a path traversal vulnerability via CSV import `image` field

Published: 2026-08-28
Modified: 2026-08-28
EPSS percentile: 46%
Aliases: GHSA-xr9m-gphc-9p63
Sources: github-advisory

Summary

### Impact An authenticated user holding the `import` and `assets.update` permissions can delete arbitrary files on the server filesystem by injecting a path traversal string into an asset's `image` field via CSV import, then triggering the image deletion feature.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Packagist	snipe/snipe-it	—	8.6.2

Remediation: Upgrade to 8.6.2 or later.

References

https://github.com/advisories/GHSA-xr9m-gphc-9p63

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.