Low severity3.8NVD Advisory· Published Sep 9, 2026· Updated Sep 14, 2026
CVE-2026-86740
CVE-2026-86740
Description
Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController::destroy() and Api\\UploadedFilesController::destroy(), allowing deletion requests to report success while files remain on disk. Administrators performing attachment deletions receive success responses and see files hidden from listings, but the physical files persist on disk and remain accessible to anyone with filesystem or backup access.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3<8.7.0+ 1 more
- (no CPE)range: <8.7.0
- cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*range: <8.7.0
- Range: <8.7.0
Patches
Vulnerability mechanics
References
2- github.com/grokability/snipe-it/security/advisories/GHSA-4c4h-cpgf-h4qrnvdExploitVendor AdvisoryPatch
- www.vulncheck.com/advisories/snipe-it-before-8.7.0-attachment-deletion-reports-success-while-file-remainsnvdThird Party Advisory
News mentions
0No linked articles in our index yet.