Snipe-IT versions prior to 8.7.0 are vulnerable to OS command injection when a superadministrator restores a crafted backup archive, allowing arbitrary command execution via the MySQL client.
Snipe-IT +1
remote-code-execution
cve
vulnerability
web-vulnerability
css-injection
account-takeover
cve-2026-86751
ssrf
+8
1r
14t
1c
updated