Improper Sanitation in Snipe-IT Allows File Read and Server-Side Requests

CVE-2026-86751

What is CVE-2026-86751?

Snipe-IT prior to version 8.7.0 contains a vulnerability wherein the platform fails to properly sanitize markdown image syntax in note fields. This allows authenticated users to craft and submit malicious markdown code in checkout acceptance notes, which bypasses HTML escaping. The CommonMark parser processes this code, enabling it to resolve paths and access server files using functions like file_get_contents or cURL. Consequently, sensitive files such as the .env file, which includes critical environment variables like APP_KEY, can be exfiltrated.

References