Description
Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute arbitrary code via the app/Http/Controllers/Api/UploadedFilesController.php component
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | snipe/snipe-it | < 8.4.1 | 8.4.1 | GHSA-xg82-2hrv-hf64 |
Advisories 1
- WID-SEC-2026-1377 Snipe-IT: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 26, 2026