Critical · 9.9 CVE-2025-63601 EUVD-2025-37899GHSA-j75f-w639-68hc

Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious ba…

Published Nov 5, 2025 · Updated Dec 1, 2025 · Assigned by mitre

Description

Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system commands.

References

https://github.com/grokability/snipe-it/pull/17966
https://github.com/grokability/snipe-it/releases/tag/v8.3.3
https://dappsec.substack.com/p/snipe-it-post-authenticated-remote
https://fptcloud.com/en/cve-2025-63601-proof-of-concept/