High severity7.6NVD Advisory· Published Sep 9, 2026· Updated Sep 16, 2026
CVE-2026-86771
CVE-2026-86771
Description
Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML() function. Attackers can craft a malicious employee_num value containing an img tag with an arbitrary HTTP(S) URL to trigger server-side requests to internal services, cloud metadata endpoints, or external targets when a victim signs an asset acceptance.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4<8.7.0+ 1 more
- (no CPE)range: <8.7.0
- cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*range: <8.7.0
- Range: <8.7.0
Patches
Vulnerability mechanics
References
2- github.com/grokability/snipe-it/security/advisories/GHSA-73xg-j94v-gjcfnvdExploitVendor Advisory
- www.vulncheck.com/advisories/snipe-it-before-8.7.0-server-side-request-forgery-via-employee-numnvdThird Party Advisory
News mentions
2- Snipe-IT: 16 Authorization and Access Control Flaws Disclosed in Single BatchVypr Intelligence · Sep 10, 2026
- Snipe-IT: 25 Authorization and Access Control Flaws Disclosed in Single BatchVypr Intelligence · Sep 9, 2026