PT-2025-45120
CVE-2025-63601
·
Published
2025-11-05
·
Updated
2025-12-01
Description by
CVSS 3.1
9.9
CriticalMetricsAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Snipe-IT versions prior to 8.3.3
Description
An authenticated attacker can execute system commands by uploading a malicious backup file containing arbitrary files. The issue is a remote code execution that allows for arbitrary file uploads and subsequent command execution.
Recommendations
Update Snipe-IT to version 8.3.3 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾