Which versions of Snipe-IT are affected by CVE-2026-55474?

Snipe-IT asset management systems before version 8.5.0 contain an authenticated arbitrary file read vulnerability that exposes database credentials and application secrets stored in web-accessible…. A patch is available.

How to fix or mitigate CVE-2026-55474?

24 hours: Inventory all Snipe-IT instances and their versions; restrict network access to the application via firewall or WAF to trusted networks only; review web server access logs for abnormal file-read activity. 7 days: Immediately rotate all database passwords, API keys, and application secrets used by Snipe-IT; implement compensating controls listed below; request patch timeline from Snipe-IT vendor. 30 days: Upgrade to Snipe-IT 8.5.0 or later once released; validate in staging environment before production deployment; conduct forensic log review to identify any credential extraction.

Snipe-IT CVE-2026-55474

Q: What is the CVSS score of CVE-2026-55474?

CVE-2026-55474 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42983 HIGH

Relative Path Traversal (CWE-23)

2026-07-10 GitHub_M

GHSA-c6f4-wj38-m3g3

Information Disclosure Snipe It Grokability

7.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable authenticated endpoint (PR:L), low complexity, no user interaction; read-only arbitrary file disclosure gives C:H with I:N, A:N and scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 20:02 EUVD

Analysis Generated

Jul 10, 2026 - 19:17 vuln.today

DescriptionCVE.org

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process. This issue is fixed in version 8.5.0.

AnalysisAI

Arbitrary file read in Snipe-IT before 8.5.0 lets an authenticated user abuse the ActionlogController::displaySig endpoint, which concatenates the route's filename parameter into a private upload-directory path without sanitization, enabling relative path traversal (CWE-23) to read any file the web server process can access. The CVSS 4.0 base score is 7.1 with high confidentiality impact only; there is no public exploit identified at time of analysis and no CISA KEV listing. Because Snipe-IT stores database credentials and application secrets in web-readable files, the practical impact can extend beyond simple information disclosure toward full application compromise.

Technical ContextAI

Snipe-IT is a Laravel/PHP open-source IT asset and license management application (CPE cpe:2.3:a:grokability:snipe-it). The flaw is a relative path traversal (CWE-23), a subclass of path traversal where '../' sequences in attacker-controlled input walk above an intended base directory. Here the ActionlogController::displaySig action serves signature/upload files by joining a route-supplied filename parameter onto the private upload directory path. Because that parameter is not canonicalized or validated against a directory allow-list before the filesystem read, sequences such as '../../' escape the upload directory and resolve to arbitrary host paths, with reads executed under the PHP/web server OS user's permissions.

RemediationAI

Vendor-released patch: upgrade to Snipe-IT 8.5.0 or later, which sanitizes the filename parameter in ActionlogController::displaySig (fix commit cd69a7ea53e030e6e05f08be18daac672c8c4121 and PR https://github.com/grokability/snipe-it/pull/18927, per advisory https://github.com/grokability/snipe-it/security/advisories/GHSA-c6f4-wj38-m3g3). If immediate upgrade is not possible, apply compensating controls: restrict or filter the displaySig signature route at the reverse proxy or WAF and block request paths containing traversal sequences ('../', '..%2f', and encoded variants), with the trade-off that overly broad rules may block legitimate signature retrieval; tighten filesystem permissions so the web server user cannot read sensitive files such as the Laravel .env (accepting that the app still needs read access to its own runtime config); and reduce and strongly authenticate low-privileged accounts, since the attack requires an authenticated session. After patching, rotate any secrets (APP_KEY, database and API credentials) that may have been exposed.