CVE-2026-86733

Snipe-IT before 8.7.0 is vulnerable to OS command injection (CWE-78): when restoring an uploaded backup, the application streams the archive's SQL directly into the MySQL/MariaDB command-line client without the --binary-mode flag, so lines beginning with backslash commands such as \! are interpreted and executed as local shell commands. An authenticated superadministrator triggers it by uploading a crafted ZIP backup (POST /admin/backups/upload) and then restoring it (POST /admin/backups/restore/{filename}) without the optional 'clean' sanitizer parameter, which is not applied by default because DB_SANITIZE_BY_DEFAULT is false. Successful exploitation yields arbitrary OS command execution as the web application's operating-system user, exposing application secrets such as database credentials and the APP_KEY and allowing modification of application-writable files and data. Anyone running Snipe-IT earlier than 8.7.0 — typically self-hosted on Docker or bare metal — is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known; EPSS estimates the 30-day exploitation probability at about 0.3% and the flaw is not in the CISA KEV catalog.

What to do: Upgrade to Snipe-IT 8.7.0 or later, which adds the --binary-mode flag to the MySQL/MariaDB client invocation. Until patched, limit superadministrator access to trusted admins and ensure restores run with the 'clean' sanitizer (or set DB_SANITIZE_BY_DEFAULT=true) to sanitize the backup stream. If compromise is suspected, rotate the APP_KEY and database credentials and review application-writable files and data for tampering.