CVE-2026-86741

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before it is rendered into asset checkout confirmation emails. A user with low-privilege permissions can inject markdown image syntax or raw HTML img tags referencing local file paths or remote URLs, and the mail auto-embed library resolves those references server-side, attaching the retrieved content to the outgoing email. An attacker can thereby read sensitive server-side files such as the .env configuration containing database and application credentials, and can perform server-side request forgery (SSRF) by making the server fetch internal or remote URLs. Any Snipe-IT deployment running a version prior to 8.7.0 in which low-privileged users can influence or trigger the checkout email workflow is affected, which applies to most self-hosted instances that use asset checkout. No public proof-of-concept is known, the issue is not listed in CISA KEV, and no in-the-wild exploitation has been reported.

What to do: Upgrade to Snipe-IT 8.7.0 or later. Until patching is complete, restrict editing of category EULA text to trusted administrators and treat low-privileged user-influenced checkout emails as untrusted input. Review what sensitive files (such as .env with database and mail credentials) the Snipe-IT service account can read and what internal network services the host can reach, and rotate stored credentials if compromise is suspected.