Medium severity6.5NVD Advisory· Published Jul 10, 2026· Updated Jul 10, 2026
CVE-2026-55474
CVE-2026-55474
Description
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process. This issue is fixed in version 8.5.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
snipe/snipe-itPackagist | < 8.5.0 | 8.5.0 |
Affected products
2- Range: <8.5.0
Patches
Vulnerability mechanics
References
6- github.com/grokability/snipe-it/commit/cd69a7ea53e030e6e05f08be18daac672c8c4121nvdPatchWEB
- github.com/grokability/snipe-it/pull/18927nvdIssue TrackingPatchWEB
- github.com/grokability/snipe-it/security/advisories/GHSA-c6f4-wj38-m3g3nvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-c6f4-wj38-m3g3ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-55474ghsaADVISORY
- github.com/grokability/snipe-it/releases/tag/v8.5.0nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.