Snipe-IT EUVD-2026-43000

Exploitation requires an authenticated session with a Snipe-IT account that has been granted BOTH the import permission AND the assets.update permission - two distinct, administratively-assigned roles that must coexist on the same account. Default installations do not grant both to standard users; an administrator must have explicitly assigned this combination. The attack proceeds in two discrete stages: first, a CSV import populating the malicious image field value, and second, an explicit image deletion action - both must be performed by the attacker. Exploitation is limited to files accessible to the OS-level user under which the Snipe-IT web server process runs; files owned by root or other users with restrictive permissions may not be deletable. The vulnerability does not allow file read or code execution - only deletion. No special network positioning is required beyond access to the Snipe-IT web interface.

The provided CVSS base score of 6.5 with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H accurately reflects the threat profile. The PR:H metric is the primary mitigating factor: exploitation requires the attacker to already possess a valid account with two non-default, administratively-granted permissions - import capability and assets.update. This substantially limits the realistic attacker population to insiders, compromised high-privilege accounts, or environments with overly permissive RBAC configurations. No EPSS score was provided in the source data, and the vulnerability is not listed in the CISA KEV catalog. No public proof-of-concept has been identified. Despite the high integrity and availability impact ratings, the real-world priority is moderate: organizations should patch promptly but this is not an emergency requiring immediate out-of-band remediation unless the affected permission set is broadly granted. The absence of confidentiality impact (C:N) is notable - this vulnerability cannot be used to exfiltrate data, only to destroy it, including potentially critical server files (configuration, keys, application binaries) depending on server process permissions.

An attacker who controls a Snipe-IT account with both import and assets.update permissions prepares a CSV file containing a crafted asset image field value such as '../../var/www/snipe-it/.env' or another sensitive server path. After importing the CSV via the standard import interface, the attacker triggers the asset image deletion action on the affected record, causing the server to delete the targeted file outside the intended upload directory. No public proof-of-concept has been identified, but the two-step attack requires no advanced tooling and is straightforwardly repeatable given the described permissions.