CVE-2026-55469 Snipe-IT: Path traversal vulnerability via CSV import `image` field

What is CVE-2026-55469?

CVE-2026-55469 is a medium-severity vulnerability in Snipeitapp Snipe-It, published on 10 Jul 2026.

Official description

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process. This issue is fixed in version 8.6.2.

Weakness: CWE-22

Which versions are affected by CVE-2026-55469?

2 open source packages ship an affected version, including snipe/snipe-it. It affects 1 product.

Products include Snipeitapp Snipe-It.

How do I fix CVE-2026-55469?

Upgrade snipe/snipe-it to 8.6.2 or later.

Is CVE-2026-55469 being exploited?

There is no known exploitation of CVE-2026-55469 in the wild and no public exploit code.

Other vulnerabilities in Snipeitapp Snipe-It

• CVE-2025-63601 File upload in n/a Critical 9.9
• CVE-2026-37709 Snipe-IT has insecure permissions in file uploads Critical 9.8
• CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS Critical 9.3
• CVE-2026-116199 Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback Critical 9.2
• CVE-2022-1380 Stored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it Critical 9.1

All Snipeitapp Snipe-It vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xr9m-gphc-9p63.