CVE-2026-86741

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description Insufficient sanitization of the category EULA text field allows users with low-privilege permissions to inject markdown image syntax or raw HTML img tags. These tags can point to local files or remote URLs, which the mail auto-embed library resolves server-side and includes as email attachments. This behavior enables Server-Side Request Forgery (SSRF), a technique where an attacker induces the server to make requests to an unintended location, and the exfiltration of sensitive files such as .env credentials.

Recommendations Update to version 8.7.0 or later.