CVE-2026-86740 Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains
Attackers with filesystem or backup access can retrieve deleted attachments because the application falsely reports successful deletion while files remain on disk.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86740?
CVE-2026-86740 is a medium-severity vulnerability in Snipeitapp Snipe-It, published on 9 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController::destroy() and Api\\UploadedFilesController::destroy(), allowing deletion requests to report success while files remain on disk. Administrators performing attachment deletions receive success responses and see files hidden from listings, but the physical files persist on disk and remain accessible to anyone with filesystem or backup access.
Weakness: CWE-212
Which versions are affected by CVE-2026-86740?
It affects 1 product.
Products include Snipeitapp Snipe-It.
How do I fix CVE-2026-86740?
No fix has been published for CVE-2026-86740 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-86740 being exploited?
There is no known exploitation of CVE-2026-86740 in the wild and no public exploit code.
Other vulnerabilities in Snipeitapp Snipe-It
- CVE-2025-63601 File upload in n/a
- CVE-2026-37709 Snipe-IT has insecure permissions in file uploads
- CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS
- CVE-2026-116199 Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback
- CVE-2022-1380 Stored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it
Sources
Also known as GHSA-4c4h-cpgf-h4qr, GHSA-h44w-5jv8-3j3q.