Описание
Snipe-IT vulnerable to directory traversal in displaySig
Impact
The displaySig action in ActionlogController serves signature image files from a private upload directory. The filename parameter from the HTTP route is concatenated directly into a filesystem path with no sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process.
Reported by https://github.com/securin-public
Ссылки
- https://github.com/grokability/snipe-it/security/advisories/GHSA-c6f4-wj38-m3g3
- https://nvd.nist.gov/vuln/detail/CVE-2026-55474
- https://github.com/grokability/snipe-it/pull/18927
- https://github.com/grokability/snipe-it/commit/cd69a7ea53e030e6e05f08be18daac672c8c4121
- https://github.com/grokability/snipe-it/releases/tag/v8.5.0
Пакеты
snipe/snipe-it
< 8.5.0
8.5.0
Связанные уязвимости
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process. This issue is fixed in version 8.5.0.
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Act ...