CyberRota Analysis
AI-GeneratedSnipe-IT versions prior to 8.7.0 are vulnerable due to inadequate sanitization of the category EULA text field, allowing low-privilege attackers to inject markdown or HTML image tags. This can lead to the exfiltration of sensitive files, such as .env credentials, and facilitate server-side request forgery (SSRF) attacks. Organizations using affected versions should prioritize patching to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed library resolves server-side and returns as email attachments, exfiltrating sensitive files like .env credentials and enabling SSRF attacks.
Related CVEs
Other vulnerabilities affecting the same vendor(s)