CVE-2026-86749

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description An issue exists where the application fails to verify the return value of storage write operations within the ImageUploadRequest::handleImages() function. Due to the default disk mode of the Laravel framework not throwing exceptions on failure, a failed Storage::disk('public')->put(...) call results in the application deleting the previous image via deleteExistingImage() and updating the database reference to a new filename that was never actually written to disk. Similarly, a failure in Storage::delete() within deleteExistingImage() can null the image field in the database while leaving the file on the disk. This condition occurs when an authenticated user uploads an image during a storage backend failure, such as S3 network errors, filesystem permission issues, or quota exhaustion, leading to unrecoverable data loss and database inconsistency. This affects multiple models including assets, users, companies, manufacturers, locations, categories, suppliers, and departments.

Recommendations Update to version 8.7.0.