---
id: CVE-2026-55474
title: Snipe-IT is an IT asset/license management system
summary: >-
  Snipe-IT is an IT asset/license management system. Prior to 8.5.0,
  ActionlogController::displaySig concatenates the route filename parameter into
  a private upload-directory path without sanitization, allowing an
  authenticated attacker to…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-23
vendor: snipeitapp
product: snipe-it
affected:
  - snipe-it < 8.5.0
patched:
  - snipe-it 8.5.0
published: '2026-07-10'
updated: '2026-07-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55474'
references:
  - url: >-
      https://github.com/grokability/snipe-it/commit/cd69a7ea53e030e6e05f08be18daac672c8c4121
    label: security-advisories@github.com
  - url: 'https://github.com/grokability/snipe-it/pull/18927'
    label: security-advisories@github.com
  - url: 'https://github.com/grokability/snipe-it/releases/tag/v8.5.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-c6f4-wj38-m3g3
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00329
epssPercentile: 0.26297
ingestedAt: '2026-07-11T20:15:26.384Z'
---

## Overview

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process. This issue is fixed in version 8.5.0.

## Affected

- `snipe-it < 8.5.0`

## Remediation

Upgrade past the affected range:

- `snipe-it 8.5.0`