CyberRota Analysis
AI-GeneratedSnipe-IT versions prior to 8.7.0 are vulnerable due to improper handling of file deletion requests, which can lead to files remaining on disk despite successful deletion messages. This flaw allows unauthorized access to the files for anyone with filesystem or backup access, posing a risk to sensitive data. Administrators managing file attachments should prioritize updating to the latest version to mitigate this issue.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController::destroy() and Api\\UploadedFilesController::destroy(), allowing deletion requests to report success while files remain on disk. Administrators performing attachment deletions receive success responses and see files hidden from listings, but the physical files persist on disk and remain accessible to anyone with filesystem or backup access.