Skip to content
Threat Feed
Subscribe
high advisory updated

Arbitrary Command Execution in Snipe-IT Backup Restoration

Snipe-IT versions prior to 8.7.0 are vulnerable to OS command injection when a superadministrator restores a crafted backup archive, allowing arbitrary command execution via the MySQL client.

CVE search metadata

CVE search record: CVE-2026-86733. Severity: high. CVSS: 7.2. KEV: no. Product: Snipe-IT (< 8.7.0), Snipe-IT (<= 8.6.3). Brief: Arbitrary Command Execution in Snipe-IT Backup Restoration. Brief link: https://feed.craftedsignal.io/briefs/2026-09-snipe-it-rce/

What's new

  • 1. added coverage for Snipe-IT (<= 8.6.3) Sep 9, 16:58 via nvd
  • 2. added coverage for Snipe-IT (< 8.7.0) Sep 9, 14:59 via nvd
  • 3. added coverage for Snipe-IT (< 8.7.0) Sep 9, 14:59 via nvd
  • 4. added coverage for Snipe-IT (< 8.7.0) Sep 9, 14:59 via nvd
  • 5. added detection rule: Detect CVE-2026-86759 Exploitation - Unauthorized POST to /hardware/history Sep 9, 14:59 via nvd

Snipe-IT versions before 8.7.0 contain a critical vulnerability (CVE-2026-86733) that allows an authenticated superadministrator to achieve arbitrary operating-system command execution. The vulnerability exists within the backup restoration process, where the application streams SQL content from an uploaded backup archive directly into the mysql or mariadb command-line client. Because the client is invoked without the --binary-mode flag, it interprets sequences starting with backslashes as local shell commands. An attacker with superadministrator privileges can supply a malicious ZIP archive containing a crafted SQL file to the /admin/backups/upload endpoint and trigger a restore via POST /admin/backups/restore/{filename}. If the clean sanitizer parameter is omitted, which is the default configuration unless DB_SANITIZE_BY_DEFAULT is enabled, the embedded shell directives are executed by the underlying operating system user running the web application. This leads to full system compromise, including the exfiltration of application secrets like APP_KEY and database credentials.

Impact

Successful exploitation allows a malicious superadministrator to execute arbitrary commands on the server hosting the Snipe-IT application. This results in the complete loss of confidentiality, integrity, and availability of the application, including access to database content, environment configuration, and potential lateral movement from the host system.

Recommendation

  1. Upgrade Snipe-IT to version 8.7.0 or later immediately.
  2. If an immediate upgrade is not possible, ensure the DB_SANITIZE_BY_DEFAULT configuration parameter is set to true to force sanitization during backup restoration.
  3. Restrict access to the superadministrator role to trusted personnel only, as exploitation requires high-level administrative access.
  4. Audit logs for POST requests to /admin/backups/upload and /admin/backups/restore/ to identify anomalous administrative behavior.

Immediate actions

Upgrade Snipe-IT to 8.7.0

IT Operations 24h

Mitigations

Set DB_SANITIZE_BY_DEFAULT to true

immediate IT Operations

CVE-2026-86733

Detection coverage 1

Detect CVE-2026-86759 Exploitation - Unauthorized POST to /hardware/history

high

Detects unauthorized attempts to modify hardware history by monitoring POST requests to the /hardware/history endpoint.

sigma tactics: persistence techniques: T1565.002 sources: webserver

Detection queries are available on the platform. Get full rules →