Summary
Snipe-IT vulnerable to directory traversal in displaySig
Advisory details
Impact
The displaySig action in ActionlogController serves signature image files from a private upload directory. The filename parameter from the HTTP route is concatenated directly into a filesystem path with no sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process.
Reported by https://github.com/securin-public
References
- https://github.com/advisories/GHSA-c6f4-wj38-m3g3
- https://github.com/grokability/snipe-it/security/advisories/GHSA-c6f4-wj38-m3g3
- https://nvd.nist.gov/vuln/detail/CVE-2026-55474
- https://github.com/grokability/snipe-it/pull/18927
- https://github.com/grokability/snipe-it/commit/cd69a7ea53e030e6e05f08be18daac672c8c4121
- https://github.com/grokability/snipe-it/releases/tag/v8.5.0
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-63490
Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass
- HIGHCVE-2026-59832
Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db
- MEDIUMGHSA-w8j7-39hp-8x59
Cloudreve's remote download file paths can escape the selected destination directory
- MEDIUMCVE-2026-55062
uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability
- HIGHCVE-2026-54910
FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files
- HIGHCVE-2026-55100
hashi-vault-js has a path traversal and query parameter injection