CVE-2026-37709

The vulnerability exists in the component app/Http/Controllers/Api/UploadedFilesController.php, responsible for handling files uploaded via API. Improper permissions (CWE-284) allow an attacker to upload and execute a malicious file without needing permissions or authentication. Over the network, without any additional conditions, an attacker can deliver a payload leading to code execution (RCE) on the server.

An attacker can execute arbitrary code on the vulnerable server, leading to complete system compromise, data breach, and violation of confidentiality, integrity, and availability of the application and its data.

Snipe-IT should be updated to a version containing commit 676a9958 (published 2026-03-10) or later. Detailed information is available in the official security advisory on GitHub: https://github.com/grokability/snipe-it/security/advisories/GHSA-xg82-2hrv-hf64

Snipeitapp Snipe-IT version 8.4.0 and earlier (vulnerability fixed after commit 676a9958 from 2026-03-10)