Vulnerability · Published Sep 9, 2026 · Assigned by VulnCheck

CVE-2026-86771Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num

High 7.6

In plain English

A high-severity server-side request forgery in snipe-it from grokability. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.3%top 74.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML() function. Attackers can craft a malicious employee_num value containing an img tag with an arbitrary HTTP(S) URL to trigger server-side requests to internal services, cloud metadata endpoints, or external targets when a victim signs an asset acceptance.

Affected products (as reported)

Vendor	Product	Versions
grokability	snipe-it	8.6.3 – before 8.7.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:L

References

GitHub Security Advisory (GHSA-73xg-j94v-gjcf) vendor-advisory
VulnCheck Advisory: Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num third-party-advisory