CVE-2026-86733 in Snipe-IT
Summary
by MITRE • 09/08/2026
Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (`mysql`) without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as `\!` as local shell commands. An authenticated superadministrator who uploads a crafted ZIP backup (POST /admin/backups/upload) and triggers a restore (POST /admin/backups/restore/{filename}) without the optional `clean` sanitizer parameter — which is not applied by default because DB_SANITIZE_BY_DEFAULT is false — can execute arbitrary OS commands as the web application's operating-system user, exposing application secrets (including database credentials and APP_KEY) and allowing modification of application-writable files and data. Version 8.7.0 adds the --binary-mode flag to the client invocation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in Snipe-IT versions prior to 8.7.0 represents a critical command injection flaw rooted in improper handling of SQL backup archives during the restoration process. The core technical deficiency lies in how the application invokes the MySQL or MariaDB command-line client to import data from uploaded ZIP files. Specifically, when processing these backups, the software passes the SQL content directly into the mysql executable without enabling binary mode via the --binary-mode flag. This omission is significant because the MySQL command-line interface interprets lines starting with a backslash as special local shell commands rather than standard SQL statements. Consequently, if an uploaded backup archive contains a line beginning with \!, which corresponds to the system command execution directive in MySQL, the underlying operating system will execute that command string directly through the default shell associated with the web application's user context.
This flaw is exploitable by any authenticated superadministrator due to insufficient input validation and sanitization during the upload and restore workflow. The attack vector involves two primary steps: first, uploading a crafted ZIP file containing malicious SQL entries via the POST /admin/backups/upload endpoint; second, triggering the restoration of this archive through the POST /admin/backups/restore/{filename} endpoint. Crucially, while Snipe-IT offers an optional clean parameter intended to sanitize input by stripping out dangerous characters or commands, this feature is not applied by default because the configuration variable DB_SANITIZE_BY_DEFAULT is set to false. This design choice leaves the system vulnerable unless explicitly configured otherwise by the administrator, creating a significant gap in defense-in-depth strategies for typical deployments that rely on default settings.
The operational impact of this vulnerability is severe, amounting to full remote code execution as the user account under which the web server operates. An attacker can leverage this capability to exfiltrate sensitive application secrets stored within the environment or configuration files, including database credentials and the APP_KEY used for encrypting data. Beyond credential theft, the ability to execute arbitrary OS commands allows an adversary to modify any file writable by the web user, potentially altering application logic, planting backdoors, or pivoting further into the internal network infrastructure. This level of access effectively compromises the integrity, confidentiality, and availability of the entire Snipe-IT installation and its associated data stores.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The exploitation technique maps to ATT&CK T1059 Command and Scripting Interpreter, specifically leveraging system-level commands through the mysql client interface. To mitigate this risk, organizations running Snipe-IT must immediately upgrade to version 8.7.0 or later, where the developers have patched the issue by adding the --binary-mode flag to the MySQL client invocation. This change ensures that lines beginning with backslashes are treated as literal data rather than executable commands, thereby neutralizing the injection vector. Additionally, administrators should review their configuration settings and consider enabling DB_SANITIZE_BY_DEFAULT if they cannot upgrade immediately, although upgrading remains the definitive remediation strategy for this critical flaw.