CVE-2026-55469

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.2

Description An authenticated user with import and assets.update permissions can perform a path traversal attack by inserting a malicious string into an asset image field during a CSV import. By subsequently triggering the image deletion process, the user can delete arbitrary files that are accessible to the server process. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations Update to version 8.6.2.