Snipe-IT: Directory traversal in displaySig
Priority LOW 32CWE-23Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-23 and the CVSS impact.
Summary
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process. This issue is fixed in version 8.5.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00484 41st percentileScored 2026-11-07
Fix Fixed snipe-it (grokability): 8.5.0snipe/snipe-it (Packagist): 8.5.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| grokability | snipe-it | before 8.5.0 | 8.5.0 | Patch available | CNA |
| — | snipe/snipe-it (Packagist) | before 8.5.0 | 8.5.0 | Patch available | GHSA-c6f4-wj38-m3g3 |
- snipe-it Vendorgrokability Affected before 8.5.0 Fixed in 8.5.0 Patch available CNA
- snipe/snipe-it (Packagist) Vendor— Affected before 8.5.0 Fixed in 8.5.0 Patch available GHSA-c6f4-wj38-m3g3
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* | before 8.5.0 | Vulnerable | grokability |
- cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* Versions before 8.5.0 Vulnerable ·grokability
Remediation
- Fix · CNA snipe-it (grokability) Fixed in 8.5.0
- Fix · GHSA-c6f4-wj38-m3g3 snipe/snipe-it (Packagist) Fixed in 8.5.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55474
- 2026-10-03 Alias added: GHSA-c6f4-wj38-m3g3
References
Patch 3
More grokability Snipe-it vulnerabilities
- TI-2026-45238 Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API CVSS 3.1HIGH 8.7
- TI-2026-59327 Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation CVSS 4.0HIGH 8.6
- TI-2026-44513 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers CVSS 3.1HIGH 8.4
- TI-2023-05072 Cross-Site Request Forgery (CSRF) in snipe/snipe-it CVSS 3.1HIGH 8.8
- TI-2026-59308 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown CVSS 4.0HIGH 8.4
- TI-2026-59298 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA CVSS 4.0HIGH 8.4
Sources
- CVE-2026-55474 · CVE Program
- CVE-2026-55474 · NVD
- FIRST EPSS
- GHSA-c6f4-wj38-m3g3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences