CVE-2026-86748
Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive
- State
- Published
- Severity
- 6.9 Medium
- Published
- Sep 9, 2026
- Updated
- Sep 9, 2026
- Reserved
- Sep 8, 2026
Description
Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H | VulnCheck |
Weaknesses
- CWE-460 Improper Cleanup on Thrown Exception
Affected Products
| Product | Versions |
|---|---|
snipe-itgrokability |
|
References
- GitHub Security Advisory (GHSA-4cr5-3hw8-8w5f)vendor-advisory
- VulnCheck Advisory: Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archivethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.