CVE-2026-55474

Snipe-IT: Directory traversal in displaySig

View on CVE.org
Published Jul 10, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Description
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process. This issue is fixed in version 8.5.0.

Analysis

AI-generated

Technical impact

Snipe‑IT versions prior to 8.5. private upload‑directory path, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process. This vulnerability, classified as CWE‑23, can lead to the disclosure of sensitive system or application data without affecting integrity or availability.

Affected Systems

The affected product is the Snipe‑IT IT asset management system from grokability. All releases before version 8.5.0 are impacted; later versions include the fix.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity risk. that the The EPSS score of < 1% demonstrates that exploitation is unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog, so there are no known active exploitation campaigns targeting it. Nevertheless, environments with exposed or minimally protected Snipe‑IT instances remain at risk.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Snipe‑IT to version 8.5.0 or newer, which contains the patch be applied immediately, restrict or disable the ActionlogController::displaySig endpoint for all non‑admin roles, preventing authenticated users from invoking the vulnerable functionality.
  • As a short‑term containment measure, configure the web server to limit file read permissions to the intended upload directories and disable directory listing to reduce the damage surface.
  • Add network segmentation or firewall rules to isolate the Snipe‑IT instance from critical server components, limiting potential lateral movement if an attacker gains access to arbitrary files.

Generated by OpenCVE AI on August 1, 2026 at 12:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-c6f4-wj38-m3g3 Snipe-IT vulnerable to directory traversal in displaySig
History
Type Values Removed Values Added
First Time appeared Grokability
Grokability snipe-it
Vendors & Products Grokability
Grokability snipe-it
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process. This issue is fixed in version 8.5.0.
Title Snipe-IT: Directory traversal in displaySig
Weaknesses CWE-23
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-23

    Relative Path Traversal

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Jul 10, 2026, 7:12 PM
Reserved
Jun 16, 2026, 10:10 PM

View source JSON

Updated
Jul 10, 2026, 7:12 PM

JSON

Status
Analyzed
Published
Jul 10, 2026, 7:17 PM
Modified
Oct 25, 2026, 3:10 PM

View source JSON

No data.

Updated
Aug 1, 2026, 12:30 PM

JSON