Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-86748

Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive

Description

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

grokability snipe-it

Default version status: unaffected

  • 0 to < 8.7.0affected
  • 8.7.0unaffected

References