CVE-2026-86771

Snipe-IT versions before 8.7.0 do not HTML-escape the employee_num field when generating asset acceptance PDFs, allowing an attacker who holds the users.edit permission to store a value containing HTML such as an img tag pointing to an attacker-chosen HTTP(S) URL. When a user signs an asset acceptance, the unescaped value is passed into TCPDF's writeHTML() function, causing the Snipe-IT server itself to fetch the embedded URL. The result is server-side request forgery (CWE-918): the attacker can make the server send requests to internal services, cloud instance metadata endpoints, or arbitrary external hosts, and the 8.3 (High) CVSS 4.0 rating reflects potentially high confidentiality impact for the vulnerable system. All self-hosted Snipe-IT deployments running a version older than 8.7.0 are affected; practical exploitability depends on the presence of at least one account with users.edit privileges and on users actually completing acceptance flows. No public proof-of-concept, CISA KEV listing, or reports of in-the-wild exploitation are known at this time.

What to do: Upgrade to Snipe-IT 8.7.0 or later, which HTML-escapes the employee_num field in the acceptance PDF generator. Until upgraded, restrict the users.edit permission to trusted administrators and audit user records for employee_num values containing HTML tags such as <img>. For cloud-hosted instances, consider restricting the application server's outbound access (e.g., to the instance metadata endpoint) to limit what an SSRF can reach.