Snipe‑IT before version 8.7.0 streams the SQL content of an uploaded backup archive directly into the MySQL/MariaDB command‑line client without the --binary‑mode flag. This omission allows the client to interpret backslash commands such as \! as shell commands. An authenticated superadministrator can upload a crafted ZIP backup and trigger its restoration, which, because DB_SANITIZE_BY_DEFAULT is false, does not apply the optional clean sanitizer. As a result, the web application’s operating‑system user can execute arbitrary OS commands, exposing database credentials, application secrets, and enabling modification of filesystem‑writable data. The weakness aligns with CWE‑78.

Snipe‑IT instances deployed with a version older than 8.7.0 are affected; this includes any installation using the grokability:snipe‑it product before the 8.7.0 release. No exact patch level list is given, so all pre‑8.7.0 deployments should be evaluated.

The CVSS v3.1 score of 8.6 indicates a high‑severity vulnerability. While the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, it still poses a significant risk because it requires only authenticated superadmin privileges, which are often available to users that need to perform routine backup management. The attack path requires uploading a malicious backup zip and initiating a restore, actions that are routine for privileged users. Once executed, the attacker can run system commands with web‑app user rights and compromise the application and underlying infrastructure.