CVE-2026-55469

Summary

Snipe-IT has a path traversal vulnerability via CSV import `image` field

Severity

low

EPSS

0.6% (p46)

CWE

CWE-22

Also known as

GHSA-xr9m-gphc-9p63

Published

2026-08-28

Updated

2026-08-28

Advisory details

Impact

An authenticated user holding the import and assets.update permissions can delete arbitrary files on the server filesystem by injecting a path traversal string into an asset's image field via CSV import, then triggering the image deletion feature.

References

• https://github.com/advisories/GHSA-xr9m-gphc-9p63
• https://github.com/grokability/snipe-it/security/advisories/GHSA-xr9m-gphc-9p63
• https://nvd.nist.gov/vuln/detail/CVE-2026-55469
• https://github.com/grokability/snipe-it/commit/abc4363e8393b29a5566b8c50144426af72bbc97
• https://github.com/grokability/snipe-it/releases/tag/v8.6.2

Related advisories

• CVE-2026-55843 — high · Packagist/snipe/snipe-it
• CVE-2026-55516 — high · Packagist/snipe/snipe-it
• CVE-2026-55474 — high · Packagist/snipe/snipe-it
• CVE-2026-55460 — high · Packagist/snipe/snipe-it
• CVE-2026-55694 — high · Packagist/snipe/snipe-it
• CVE-2026-55515 — medium · Packagist/snipe/snipe-it
• CVE-2026-55481 — medium · Packagist/snipe/snipe-it
• CVE-2026-55479 — medium · Packagist/snipe/snipe-it

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity