---
id: CVE-2026-86749
title: >-
  Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of
  storage write operations in ImageUploadRequest::handleImages()
summary: >-
  Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of
  storage write operations in ImageUploadRequest::handleImages(). Because
  Laravel's default disk mode does not throw on failure, a silently failed
  Storage::disk('…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L'
cwe:
  - CWE-252
vendor: snipeitapp
product: snipe-it
affected:
  - snipe-it < 8.7.0
patched:
  - snipe-it 8.7.0
published: '2026-09-09'
updated: '2026-09-19'
sourceUpdated: '2026-09-19T15:17:07.153'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86749'
references:
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-v37p-hr9x-5w85
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-data-loss-via-failed-image-write
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00339
epssPercentile: 0.24643
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-18T17:43:00.810544Z'
ingestedAt: '2026-09-09T14:11:29.380Z'
---

## Overview

Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in ImageUploadRequest::handleImages(). Because Laravel's default disk mode does not throw on failure, a silently failed Storage::disk('public')->put(...) call still caused the application to delete the previous image via deleteExistingImage() and to reassign and persist the model's image reference to the new filename, destroying the existing image and leaving the database row pointing at a file that was never written. A mirror problem existed in deleteExistingImage(), where a failed Storage::delete() still nulled the model's image field, orphaning the file on disk. The condition is not directly attacker-controlled: it is triggered when any legitimate authenticated user submits an image upload while the storage backend transiently fails (for example an S3 network error, a local filesystem permission problem, or quota exhaustion). The result is unrecoverable loss of the prior image and a durable inconsistency between the database and disk that requires manual reconciliation. All models whose controllers route through ImageUploadRequest::handleImages (assets, asset models, users, companies, manufacturers, locations, categories, suppliers, departments, and other image-carrying models) are affected.

## Affected

- `snipe-it < 8.7.0`

## Remediation

Upgrade past the affected range:

- `snipe-it 8.7.0`