{"id":"CVE-2026-86741","aliases":["GHSA-qmhc-p47c-6x75"],"url":"https://o3.security/vulnerability/CVE-2026-86741","summary":"Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA","details":"Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed library resolves server-side and returns as email attachments, exfiltrating sensitive files like .env credentials and enabling SSRF attacks.","published":"2026-09-09T13:32:07.141Z","modified":"2026-09-10T03:48:34.217975395Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86741.json"},{"type":"ADVISORY","url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-qmhc-p47c-6x75"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86741"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-arbitrary-file-read-and-ssrf-via-category-eula"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:48:34.217975395Z"}}