CVE-2026-86740

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description An issue exists where the system fails to verify the return value of the Storage::delete() function within UploadedFilesController::destroy() and ApiUploadedFilesController::destroy(). This allows deletion requests to report success even if the files remain on the disk. Consequently, while administrators see files hidden from listings, the physical files persist and remain accessible to individuals with filesystem or backup access.

Recommendations Update Snipe-IT to version 8.7.0 or later.