CVE-2026-55469: Snipe-IT has a path traversal vulnerability via CSV import `image` field

August 28, 2026

An authenticated user holding the import and assets.update permissions can delete arbitrary files on the server filesystem by injecting a path traversal string into an asset’s image field via CSV import, then triggering the image deletion feature.

References

github.com/advisories/GHSA-xr9m-gphc-9p63
github.com/grokability/snipe-it/commit/abc4363e8393b29a5566b8c50144426af72bbc97
github.com/grokability/snipe-it/releases/tag/v8.6.2
github.com/grokability/snipe-it/security/advisories/GHSA-xr9m-gphc-9p63
nvd.nist.gov/vuln/detail/CVE-2026-55469

Code Behaviors & Features

Detect and mitigate CVE-2026-55469 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →