CVE-2026-86749
Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in ImageUploadRequest::handleImages(). Because Laravel's default disk mode does not throw on failure, a silently failed Storage::disk('public')->put(...) call still caused the application to delete the previous image via deleteExistingImage() and to reassign and persist the model's image reference to the new filename, destroying the existing image and leaving the database row pointing at a file that was never written. A mirror problem existed in deleteExistingImage(), where a failed Storage::delete() still nulled the model's image field, orphaning the file on disk. The condition is not directly attacker-controlled: it is triggered when any legitimate authenticated user submits an image upload while the storage backend transiently fails (for example an S3 network error, a local filesystem permission problem, or quota exhaustion). The result is unrecoverable loss of the prior image and a durable inconsistency between the database and disk that requires manual reconciliation. All models whose controllers route through ImageUploadRequest::handleImages (assets, asset models, users, companies, manufacturers, locations, categories, suppliers, departments, and other image-carrying models) are affected.
Scoring
- Severity
- HIGH
- CVSS base score
- 7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
- CWE
- CWE-252
- Published
- 2026-09-09
- Last modified
- 2026-09-09
Affected products
- grokability snipe-it
- grokability snipe-it
Weakness type
Related vulnerabilities
- CVE-2026-86739 — Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence
- CVE-2026-86141 — xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a...
- CVE-2026-19534 — undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
- CVE-2026-85649 — (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation...
- CVE-2026-14957 — FIPS mode assertion failure via malicious CERT payload
- CVE-2026-78699 — rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres
- CVE-2026-79772 — Nokogiri before 1.19.1 Unchecked Return Value canonicalize
- CVE-2026-77641 — tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails....