CVE-2026-86733 is a high severity OS command injection in Snipe-IT before 8.7.0. When a superadministrator restores an uploaded backup, the SQL entry is streamed to the MySQL or MariaDB client without its binary-mode flag, so backslash commands inside it can run shell commands. Version 8.7.0 adds that flag.
What's affected
Affected: Snipe-IT before 8.7.0. Patched version: 8.7.0, which adds the binary mode flag to the client invocation. This is stated in the record and in the GitHub advisory GHSA-x53f-48vj-c5fc.
Severity differs across sources. The record gives CVSS 3.1 at 7.2 (High). The GitHub advisory rates it High. VulnCheck gives 8.6 on CVSS 4.0. All treat it as High, and the 7.2 reflects the need for a highly privileged account.
The attacker needs an authenticated superadministrator session. The record notes that the optional clean sanitizer is not applied by default, because DB_SANITIZE_BY_DEFAULT is false. The advisory adds that if a separate flaw grants superadmin access, the combined chain deserves more weight. Nothing I read reports exploitation, and it is not in CISA KEV.
How to check if you're exposed
Check your Snipe-IT version. The web interface shows it in the footer and on the admin settings pages. For Docker, read the image tag, and for a Git install, run the command below in the application directory. Anything before 8.7.0 is affected.
git describe --tags
Then review who holds the highest privilege. The attack described needs a superadministrator or superuser account, so list those accounts, remove ones you do not need, and make sure each uses a unique password and multi factor authentication where available.
What to do now
- Upgrade Snipe-IT to 8.7.0 or later and note the change in your records.
- Do not restore backup archives from sources you do not control, and treat uploaded backups as untrusted input until you have upgraded.
- Keep the number of superadministrator accounts small, and protect them with unique passwords.
- Review file and database access for the web service account, since command execution would run as that account.
- If you suspect misuse, rotate the database credentials and APP_KEY, which the advisory lists as readable by that account.
Why it matters
The weakness is OS command injection (CWE-78). The MySQL and MariaDB command line client treats certain lines that begin with a backslash as client commands, including one that runs a local shell command. Feeding it an uploaded file without asking it to treat input as binary data means the file's content is interpreted as commands rather than as data.
The advisory describes the impact as arbitrary shell commands as the web service account. In the official Docker image that account is an unprivileged user, but the reach is still large: application secrets including database credentials and APP_KEY, application data and storage, and writable files. Container escape is possible depending on mounts and privileges.
The precondition keeps this from being an internet wide crisis, but asset management systems hold sensitive inventory data, and superadministrator access is often shared. Patch, and treat backups as code.
Quick check
Who can exploit it?
Only an authenticated superadministrator, according to the record and advisory.
What does 8.7.0 change?
It adds the binary mode flag when streaming the SQL entry into the database client, so backslash commands are no longer interpreted.
Sources
- Snipe-IT GitHub advisory GHSA-x53f-48vj-c5fc
- VulnCheck advisory
- Safeguard Gold entry for CVE-2026-86733
Last reviewed: 18 October 2026.
