CVE-2026-86733

    Dashboard / Vulnerabilities / CVE-2026-86733

    CVE-2026-86733

    Published: 8 Sept 2026Last Modified: 11 Sept 2026

    Summary: Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore

    Details: Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (`mysql`) without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as `\!` as local shell commands. An authenticated superadministrator who uploads a crafted ZIP backup (POST /admin/backups/upload) and triggers a restore (POST /admin/backups/restore/{filename}) without the optional `clean` sanitizer parameter — which is not applied by default because DB_SANITIZE_BY_DEFAULT is false — can execute arbitrary OS commands as the web application's operating-system user, exposing application secrets (including database credentials and APP_KEY) and allowing modification of application-writable files and data. Version 8.7.0 adds the --binary-mode flag to the client invocation.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86733.json, https://github.com/grokability/snipe-it/security/advisories/GHSA-x53f-48vj-c5fc, https://nvd.nist.gov/vuln/detail/CVE-2026-86733, https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-remote-code-execution-via-backup-restore

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -1d05a7ce11e6bf9448c067ac3ffbe5e63882888e

    Affected versions

    v8.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-86733 | CVE-DB