Snipe‑IT versions prior to 8.5. private upload‑directory path, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process. This vulnerability, classified as CWE‑23, can lead to the disclosure of sensitive system or application data without affecting integrity or availability.

The affected product is the Snipe‑IT IT asset management system from grokability. All releases before version 8.5.0 are impacted; later versions include the fix.

The CVSS score of 7.1 indicates a high severity risk. that the The EPSS score of < 1% demonstrates that exploitation is unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog, so there are no known active exploitation campaigns targeting it. Nevertheless, environments with exposed or minimally protected Snipe‑IT instances remain at risk.