CVE-2026-86751 in Snipe-IT
Summary
by MITRE • 09/09/2026
Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded by CommonMark parser, and resolved by laravel-mail-auto-embed via file_get_contents or curl, exfiltrating sensitive files like .env containing APP_KEY.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in Snipe-IT versions prior to 8.7.0 represents a critical server-side request forgery and local file inclusion flaw rooted in the improper sanitization of markdown image syntax within user-controlled input fields. Specifically, this security defect affects note fields associated with checkout acceptance processes where authenticated users can inject malicious payloads. The core technical issue lies in how the application handles text that is intended to be rendered as rich content using a markdown parser. While many applications attempt to mitigate cross-site scripting by escaping HTML entities, Snipe-IT's implementation allows specific markdown constructs to bypass these initial sanitization layers. When an attacker submits a specially crafted markdown image syntax string within a checkout acceptance note, the input survives the standard HTML escaping mechanisms because it is interpreted as valid markup rather than raw text.
Once submitted, this malicious payload enters the rendering pipeline where the CommonMark parser processes the content. The vulnerability exploits the behavior of the laravel-mail-auto-embed package, which is integrated into the application's email and notification subsystems to automatically embed images from URLs provided in markdown syntax. Instead of treating the image source as a simple string for display purposes only, the system attempts to fetch or process this resource dynamically. By crafting an input that utilizes local file paths or internal network addresses within the markdown image tag, such as using protocols like file:// or pointing to localhost endpoints, the application triggers server-side operations. The laravel-mail-auto-embed component resolves these references by invoking PHP functions such as file_get_contents for local files or curl for remote URLs. This mechanism effectively turns a user-facing text field into an arbitrary read primitive and a vector for Server-Side Request Forgery without requiring any additional authentication tokens beyond the initial login, which is already possessed by the attacker due to their authenticated status.
The operational impact of this vulnerability is severe, primarily because it allows attackers with low-privileged accounts to escalate their influence significantly. The most immediate consequence is the ability to read arbitrary files from the server's filesystem where Snipe-IT is hosted. This capability enables the exfiltration of highly sensitive configuration data, including environment variables stored in .env files. These files typically contain cryptographic keys such as APP_KEY, database credentials, API secrets, and other application-specific configurations that are critical for maintaining system integrity and confidentiality. Compromise of these assets can lead to full account takeover through session forgery or decryption of encrypted user data. Furthermore, the ability to issue server-side HTTP requests expands the attack surface considerably. Attackers can use this functionality to perform internal network reconnaissance, scan private subnets, interact with internal APIs that lack external-facing authentication controls, and potentially pivot into other parts of the organization's infrastructure by making requests to services running on localhost or within trusted internal networks.
This vulnerability aligns closely with CWE-94 Improper Control of Generation of Code (Code Injection) in its broader context of server-side execution, but more specifically maps to CWE-200 Exposure of Sensitive Information to an Unauthorized Actor and CWE-611 Improper Restriction of XML External Entity Reference if viewed through the lens of external entity processing. In terms of offensive security frameworks, this behavior is characteristic of Server-Side Request Forgery (SSRF) as defined in MITRE ATT&CK technique T1572, which involves establishing a communication channel to an internal network from an initially compromised host or application component. The exploitation path also reflects CWE-918 Server Side Request Forgery (SSRF), where the server is tricked into making requests on behalf of the attacker. To mitigate this risk, organizations must immediately upgrade Snipe-IT to version 8.7.0 or later, which addresses these sanitization gaps by strictly validating and escaping markdown inputs before they reach the rendering engine. Additionally, administrators should ensure that the laravel-mail-auto-embed package is configured with strict allowlists for permitted image sources, preventing it from resolving local file paths or internal IP addresses. Implementing a Web Application Firewall rule to detect and block common SSRF patterns in input fields can also provide an additional layer of defense against similar exploitation attempts until patches are fully deployed across the environment.