CVE-2026-55469
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Jul 10, 2026
Vendor
unknown
Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process. This issue is fixed in version 8.6.2.