Snipe It Before 8.7.0 Remote Code Execution Via Backup Restore

Back www.vulncheck.com

Snipe It Before 8.7.0 Remote Code Execution Via Backup Restore

www.vulncheck.com • September 9, 2026

Share: View original

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

GitHub Security Advisory (GHSA-x53f-48vj-c5fc)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Snipe-IT Vulnerabilities: RCE and CSS Injection Risks Identified Two critical vulnerabilities have been discovered in Snipe-IT versions prior to 8.7.0. The first, a remote code execution (RCE) vulnerability, is due to improper handling of backup restores, categorized as CWE-78. The second vulnerability allows CSS injection through custom CSS, classified as CWE-79. These vulnerabilities affect all versions before 8.7.0, potentially allowing attackers to execute arbitrary code or inject malicious scripts. The vulnerabilities have been documented in GitHub Security Advisories (GHSA-x53f-48vj-c5fc and GHSA-pvcw-mp8q-mj39). Users are urged to upgrade to version 8.7.0 or later to mitigate these risks. As of now, there is no indication of active exploitation in the wild, but the vulnerabilities are significant enough to warrant immediate attention. 2 sources 57

Extracted Entities

Attack Types (1)

Remote Code Execution

CWE Weaknesses (1)

CWE-78 - OS Command Injection

MITRE ATT&CK (1)

T1059 - Command and Scripting Interpreter

Vulnerabilities (1)

OS Command Injection