Cve-2026-86751 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-86751/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 08 Sep 2026 17:45:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgArbitrary Command Execution in Snipe-IT Backup Restorationhttps://feed.craftedsignal.io/briefs/2026-09-snipe-it-rce/Tue, 08 Sep 2026 17:45:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-snipe-it-rce/Snipe-IT versions prior to 8.7.0 are vulnerable to OS command injection when a superadministrator restores a crafted backup archive, allowing arbitrary command execution via the MySQL client.Snipe-IT versions before 8.7.0 contain a critical vulnerability (CVE-2026-86733) that allows an authenticated superadministrator to achieve arbitrary operating-system command execution. The vulnerability exists within the backup restoration process, where the application streams SQL content from an uploaded backup archive directly into the mysql or mariadb command-line client. Because the client is invoked without the --binary-mode flag, it interprets sequences starting with backslashes as local shell commands. An attacker with superadministrator privileges can supply a malicious ZIP archive containing a crafted SQL file to the /admin/backups/upload endpoint and trigger a restore via POST /admin/backups/restore/{filename}. If the clean sanitizer parameter is omitted, which is the default configuration unless DB_SANITIZE_BY_DEFAULT is enabled, the embedded shell directives are executed by the underlying operating system user running the web application. This leads to full system compromise, including the exfiltration of application secrets like APP_KEY and database credentials.

Impact

Successful exploitation allows a malicious superadministrator to execute arbitrary commands on the server hosting the Snipe-IT application. This results in the complete loss of confidentiality, integrity, and availability of the application, including access to database content, environment configuration, and potential lateral movement from the host system.

Recommendation

  1. Upgrade Snipe-IT to version 8.7.0 or later immediately.
  2. If an immediate upgrade is not possible, ensure the DB_SANITIZE_BY_DEFAULT configuration parameter is set to true to force sanitization during backup restoration.
  3. Restrict access to the superadministrator role to trusted personnel only, as exploitation requires high-level administrative access.
  4. Audit logs for POST requests to /admin/backups/upload and /admin/backups/restore/ to identify anomalous administrative behavior.
]]>highadvisoryremote-code-executioncvevulnerabilityweb-vulnerabilitycss-injectionaccount-takeovercve-2026-86751ssrflfiweb-applicationasset-managementauthentication-bypasssamlidentity-managementpatch-managementprivilege-escalation