CVE-2026-86733

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description An authenticated superadministrator can execute arbitrary operating system commands as the web application user by uploading a crafted ZIP backup and triggering a restore. The issue occurs because SQL entries from the backup archive are streamed into the MySQL/MariaDB command-line client without the --binary-mode flag, causing the client to interpret lines starting with backslash commands, such as !, as local shell commands. This can lead to the exposure of application secrets, including database credentials and APP KEY, and allow the modification of application-writable files and data. The attack involves the following endpoints:

The exploitation is possible when the optional clean sanitizer parameter is not used, which is the default behavior when DB SANITIZE BY DEFAULT is false.

Recommendations Update to version 8.7.0. Avoid using the 'POST /admin/backups/restore/{filename}' endpoint with untrusted backup files until the update is applied.