CVE-2026-86751 is a high severity (CVSS 8.5) flaw in Snipe-IT, the open source IT asset manager. A signed-in user can turn a note field into a way to read files on the server and trigger server-side web requests. Versions up to 8.6.3 are affected, and 8.7.0 contains the fix.
What's affected
The record says Snipe-IT before 8.7.0 is affected. The GitHub advisory narrows that to versions up to and including 8.6.3, plus pre-release commits on the develop branch before the fix. The patched release is 8.7.0.
The attacker must be an authenticated user, and the advisory describes the path through a checkout acceptance note. The advisory also says the mail image embedding feature is enabled by default on shipped installs, so an operator does not have to turn anything on to be exposed.
How to check if you're exposed
Find the Snipe-IT version first. It is shown in the admin area of the application, and for container deployments it is the tag of the image you run:
docker ps --format "{{.Names}} {{.Image}}"
If the tag is 8.6.3 or older, you are in the affected range. If you deploy from a git checkout, compare your release tag with 8.7.0.
Then look at who can sign in. Any account that can accept an asset checkout is enough for the flaw described in the advisory, so a large user base with low trust raises the exposure. Review your mail settings too, since the advisory ties the problem to how outbound notification mail is built.
What to do now
- Upgrade Snipe-IT to 8.7.0 or later and clear caches as your deployment guide describes.
- Rotate the application key and any secrets stored in the environment file if you cannot rule out misuse. The advisory points out that the application key is in that file on default installs, and that anyone holding it can forge signed URLs and encrypted cookies.
- Review outbound notification mail from the affected period for unusual attachments on checkout acceptance messages.
- Remove accounts that no longer need access, and review which users can accept checkouts.
- Add Snipe-IT to your software inventory so the next advisory reaches the right owner.
The advisory also rates its own severity higher than the record does. GitHub lists 9.6, while the NVD style score in the record is 8.5. Either way, treat it as urgent for any instance reachable by many users.
Rotation deserves a moment of planning. Changing the application key invalidates sessions and anything encrypted with it, so schedule it and tell your users that they will need to sign in again. Take a backup of the environment file before you change it, and keep the old key available until you have confirmed that nothing else depends on it.
Why it matters
The record lists CWE-73 (external control of file name or path). The advisory describes a chain of small decisions. A note field was escaped for HTML, but markdown image syntax is not HTML, so it passed through. A markdown parser then turned it into an image tag. A mail library that embeds images in outbound messages then fetched whatever the tag pointed to, whether a local file or a URL, and attached it to the email.
No single step looks dangerous alone. The lesson is that user input should be treated as untrusted at every layer that interprets it, and that helper libraries which fetch resources on your behalf need an allowlist. The fix replaces the image renderer so markdown images produce plain text, which leaves nothing for the mail library to fetch.
The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Try it yourself
This flaw sits in how an application combines its own code with a mail library. An inventory of what your applications pull in makes that kind of link visible.
Click through it at your own pace, or open it full screen.
Quick check
Do I need to patch if only staff use Snipe-IT?
Yes. The attacker needs an account, but any account that can accept a checkout is enough, so staff access still counts. Upgrade to 8.7.0 or later.
Is there a workaround?
The advisory fix is the patch. Check the project advisory for any interim steps before relying on a configuration change.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
- https://github.com/grokability/snipe-it/security/advisories/GHSA-f3vq-g24v-xc2g
- https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-arbitrary-file-read-and-ssrf-via-markdown
Last reviewed: 19 October 2026.
