Critical severity9.9NVD Advisory· Published Nov 5, 2025· Updated Jun 17, 2026

CVE-2025-63601

Description

Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system commands.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Grokability/Snipe Itllm-fuzzy
Range: <8.3.3
Snipeitapp/Snipe It
cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*
Range: <8.3.3
Snipe IT/Snipe-ITcpe-rescue

Patches

Vulnerability mechanics

References

github.com/grokability/snipe-it/pull/17966nvdIssue TrackingPatch
github.com/grokability/snipe-it/releases/tag/v8.3.3nvdRelease Notes
dappsec.substack.com/p/snipe-it-post-authenticated-remotenvd
fptcloud.com/en/cve-2025-63601-proof-of-concept/nvd

News mentions

No linked articles in our index yet.

cvss	0.643
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000