https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T11:53:42.345120+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-335741 EUVD-2026-335741 2026-10-06T11:53:42.377157+00:00 EUVD-2026-335741 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55469 fkie_cve-2026-55469 2026-10-06T11:53:42.377194+00:00

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process. This issue is fixed in version 8.6.2.

 https://cve.radiocsirt.org/vuln/ghsa-xr9m-gphc-9p63 GHSA-xr9m-gphc-9p63 — Snipe-IT has a path traversal vulnerability via CSV import `image` field 2026-10-06T11:53:42.377228+00:00

Affected: Packagist: snipe/snipe-it

### Impact An authenticated user holding the `import` and `assets.update` permissions can delete arbitrary files on the server filesystem by injecting a path traversal string into an asset's `image` field via CSV import, then triggering the image deletion feature.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2073 WID-SEC-W-2026-2073 — Snipe-IT: Mehrere Schwachstellen 2026-10-06T11:53:42.377255+00:00

Ein Angreifer kann mehrere Schwachstellen in Snipe-IT ausnutzen, um Dateien zu manipulieren, um Sicherheitsvorkehrungen zu umgehen, um einen Cross-Site Scripting Angriff durchzuführen und um beliebigen Programmcode auszuführen.