The flaw resides in the UploadedFilesController.php of Grokability Snipe‑IT and arises from insecure file‑system permissions. A remote user can upload a crafted file through the API, causing the application to execute arbitrary code and thereby compromising confidentiality, integrity, and availability. The weakness is a classic example of improper authorization (CWE‑284).

Grokability Snipe‑IT version 8.4.0 and any earlier release are affected. The defect is resolved in commits released after 2026‑03‑10 (commit 676a9958), so installations that have not applied that update remain vulnerable.

The CVSS score of 9.8 indicates critical severity, and the lack of an EPSS score means exact exploitation likelihood cannot be quantified, though the public advisory suggests it is a high risk target. The vulnerability is not listed in the CISA KEV catalog. Exploitation is performed remotely by sending a malicious file via the upload API endpoint; successful exploitation would grant the attacker full control of the application server.