PT-2026-57267 · Snipe-It · Snipe-It

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-55474

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.5.0

Description An authenticated attacker can read arbitrary files accessible to the web server process. This occurs because the displaySig function within the ActionlogController concatenates the filename route parameter into a private upload-directory path without proper sanitization, enabling directory traversal.

Recommendations Update to version 8.5.0.

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2026-55474

Affected Products

Snipe-It

References · 6

• https://github.com/grokability/snipe-it/security/advisories/GHSA-c6f4-wj38-m3g3 · Vendor Advisory
• https://github.com/grokability/snipe-it/pull/18927 · Patch
• https://github.com/grokability/snipe-it/commit/cd69a7ea53e030e6e05f08be18daac672c8c4121 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-55474 · Security Note
• https://github.com/grokability/snipe-it/releases/tag/v8.5.0 · Note
• https://twitter.com/CVEnew/status/2075666975276048835 · Twitter Post