CVE-2026-86751

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary files on the server and trigger server-side HTTP requests (SSRF), a file/path handling flaw tracked as CWE-73. An attacker submits crafted markdown image syntax in checkout acceptance notes; the syntax survives HTML escaping, is expanded by the CommonMark parser, and the resulting image reference is fetched by laravel-mail-auto-embed using file_get_contents or curl, so the target can be a local file or an attacker-chosen URL. A low-privileged authenticated user gains arbitrary file read (e.g., exfiltrating the .env file, which contains the Laravel APP_KEY and other secrets) and can probe internal services or reach external URLs via the server-side request. All Snipe-IT deployments running any version prior to 8.7.0, where authenticated users can submit notes on checkout acceptance, are affected; the flaw is network-reachable with low privileges required, rated 8.4 High under CVSS 4.0. No public proof-of-concept or confirmed in-the-wild exploitation is currently known, and the issue is not in the CISA KEV catalog.

What to do: Upgrade to Snipe-IT 8.7.0 or later, which fixes sanitization of markdown image syntax in note fields. As interim mitigations, restrict or strip markdown image syntax from acceptance notes, limit outbound HTTP connectivity from the Snipe-IT server to block SSRF callbacks, and verify that the web server user cannot read more configuration than necessary; if compromise is suspected, rotate the APP_KEY and any other secrets stored in .env.