CVE-2026-86771

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description Insufficient HTML-escaping of the employee num field in the acceptance PDF generator allows users with users.edit permissions to inject img tags into the writeHTML() function of TCPDF. This can be exploited to trigger server-side requests to internal services, cloud metadata endpoints, or external targets when a victim signs an asset acceptance. This issue leads to Server-Side Request Forgery (SSRF), a condition where the server is coerced into making requests to an unintended location.

Recommendations Update to version 8.7.0 or later. Restrict the use of the employee num field for users with users.edit permissions until the update is applied.