What is the CVSS score of CVE-2026-55469?

CVE-2026-55469 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-55469?

Yes, a patch is available for CVE-2026-55469. Update the affected software to the latest version immediately.

Snipe-IT CVE-2026-55469

EUVD-2026-43000 MEDIUM

Path Traversal (CWE-22)

2026-07-10 security-advisories@github.com

GHSA-xr9m-gphc-9p63

Path Traversal Snipe It Snipeitapp

6.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

6.5 MEDIUM

Network vector via web interface; PR:H because both import and assets.update permissions must be held; no confidentiality impact as only deletion occurs.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 10, 2026 - 21:02 EUVD

Analysis Generated

Jul 10, 2026 - 20:44 vuln.today

DescriptionCVE.org

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process. This issue is fixed in version 8.6.2.

AnalysisAI

Arbitrary file deletion in Snipe-IT prior to 8.6.2 allows an authenticated attacker holding both import and assets.update permissions to delete any file readable by the server process via a path traversal string injected into the asset image field during CSV import. The vulnerability is triggered in a two-stage pattern: first importing a crafted CSV, then invoking the image deletion action, which follows the unsanitized path without boundary checks. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog. The fix is confirmed in the v8.6.2 release.

Technical ContextAI

Snipe-IT is an open-source PHP-based IT asset and license management platform. The vulnerability stems from CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal), where user-supplied input in the asset image field of a CSV import is not sanitized before being used in a subsequent file system operation. When the server processes a deletion request for an asset image, it constructs a file path using the stored field value without canonicalizing or validating that the resolved path remains within the intended upload directory. An attacker can supply sequences such as '../../etc/passwd' or similar traversal tokens to redirect the deletion to arbitrary locations accessible to the web server process. The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H confirms network reachability, low complexity, high privilege requirement, no scope change, and both high integrity and availability impact - consistent with arbitrary file deletion rather than file read or code execution.

RemediationAI

Upgrade Snipe-IT to version 8.6.2 or later, which contains the patch referenced in commit abc4363e8393b29a5566b8c50144426af72bbc97 (https://github.com/grokability/snipe-it/commit/abc4363e8393b29a5566b8c50144426af72bbc97). Full release details are available at https://github.com/grokability/snipe-it/releases/tag/v8.6.2 and the security advisory at https://github.com/grokability/snipe-it/security/advisories/GHSA-xr9m-gphc-9p63. If immediate upgrade is not feasible, the most effective compensating control is to audit and revoke the combined import plus assets.update permission set from any user accounts that do not strictly require both - removing either permission breaks the two-stage attack chain. Additionally, restricting the web server process user to a chroot or restricted filesystem namespace (e.g., via systemd's ReadWritePaths or AppArmor profiles) limits the blast radius of path traversal to the application directory rather than the full filesystem. Note that permission revocation may disrupt legitimate bulk import workflows for affected users.