CVE-2026-86740

Katalog CVE

CVSS 3.8 · Low EPSS 0,29%

Kerentanan Improper Removal of Sensitive Information Before Storage or Transfer pada snipeitapp snipe-it. Skor CVSS 3.1 3.8 (Low) menurut vulncheck.com.

Deskripsi (NVD)

Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController::destroy() and Api\\UploadedFilesController::destroy(), allowing deletion requests to report success while files remain on disk. Administrators performing attachment deletions receive success responses and see files hidden from listings, but the physical files persist on disk and remain accessible to anyone with filesystem or backup access.

Rincian

Terbit di NVD

9 September 2026

Terakhir diubah

14 September 2026

Status NVD

Analyzed

CVSS 3.1

3.8 (Low), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 20,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/grokability/snipe-it/security/advisories/GHSA-4c4h-cpgf-h4qr exploit · advisory vendor · patch
• https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-attachment-deletion-reports-success-while-file-rema... advisory pihak ketiga