CVE-2026-86771CWE-918ssrf

CVE-2026-86771

High · published September 9, 2026

CVSS v3.1
7.6
EPSS
0%
Percentile
23.7
In the wild
Unconfirmed
What it is

Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML() function. Attackers can craft a malicious employee_num value containing an img tag with an arbitrary HTTP(S) URL to trigger server-side requests to internal services, cloud metadata endpoints, or external targets when a victim signs an asset acceptance.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:L
CVSS v4.0
8.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L
EPSS
0.00320 · 23.7th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-09T18:17Z
Affected products (1)
ProductVersionsFixed in
snipeitapp/snipe-it< 8.7.08.7.0
References (2)
https://github.com/grokability/snipe-it/security/advisories/GHSA-73xg-j94v-gjcf · [email protected]https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-server-side-request-forgery-via-employee-num · [email protected]
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 09 SEP 13:32Z
    Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num
    cvelistv5