Summary
Snipe-IT vulnerable to directory traversal in displaySig
Advisory details
Impact
The displaySig action in ActionlogController serves signature image files from a private upload directory. The filename parameter from the HTTP route is concatenated directly into a filesystem path with no sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process.
Reported by https://github.com/securin-public
References
- https://github.com/advisories/GHSA-c6f4-wj38-m3g3
- https://github.com/grokability/snipe-it/security/advisories/GHSA-c6f4-wj38-m3g3
- https://nvd.nist.gov/vuln/detail/CVE-2026-55474
- https://github.com/grokability/snipe-it/pull/18927
- https://github.com/grokability/snipe-it/commit/cd69a7ea53e030e6e05f08be18daac672c8c4121
- https://github.com/grokability/snipe-it/releases/tag/v8.5.0
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-106490
Backstage: Improper input validation in TechDocs static content requests
- HIGHGHSA-5rmq-chc7-m22f
Vibe-Trading file-read tools expose arbitrary server-readable files
- MEDIUMCVE-2026-59149
@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
- MEDIUMCVE-2026-50024
GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server
- HIGHCVE-2026-63490
Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass
- HIGHCVE-2026-59832
Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db