Description

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed library resolves server-side and returns as email attachments, exfiltrating sensitive files like .env credentials and enabling SSRF attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-09-09T14:17:22.680Z",
  "pubdate": "2026-09-09T14:17:22.680Z",
  "executiveSummary": "Snipe-IT versions prior to 8.7.0 are susceptible to an improper input validation vulnerability within the category EULA text field. This flaw allows low-privilege authenticated users to inject malicious Markdown or HTML img tags into checkout confirmation emails. By manipulating the mail auto-embed library, an attacker can coerce the server into processing these tags, resulting in the unauthorized exfiltration of sensitive server-side files, including the .env configuration file, or the execution of Server-Side Request Forgery (SSRF) attacks. This vulnerability poses a significant risk to confidentiality and integrity, as it provides a mechanism for remote attackers to retrieve critical system credentials and environmental variables, potentially leading to a complete compromise of the application infrastructure.",
  "technicalDetails": "The root cause of this vulnerability lies in the failure to sanitize user-supplied input within the category EULA text field before it is processed by the application's mail template rendering engine. Snipe-IT utilizes a mail auto-embed library that automatically resolves embedded image resources when generating checkout confirmation emails. Because the application does not validate the source URI of these images, an attacker with low-privilege access can supply crafted Markdown image syntax or raw HTML img tags as part of the EULA content.\nThe attack flow initiates when an authenticated user updates the category EULA with a malicious payload, such as an img tag pointing to local file paths (e.g., file:///var/www/html/.env) or remote malicious URLs. When the system triggers a checkout confirmation email, the mail auto-embed library parses the content. If a local file path is provided, the underlying engine attempts to read the file from the filesystem to embed it as an email attachment. If a remote URL is provided, the engine performs an HTTP request, facilitating SSRF, where the server acts as a proxy to probe internal or external network resources.\nThe inclusion of sensitive files like .env as email attachments effectively exfiltrates critical configuration data, including database credentials, application keys, and third-party service tokens. This behavior bypasses traditional perimeter security controls because the exfiltration occurs via the outbound mail delivery path. Furthermore, the SSRF capability allows an attacker to interact with services reachable by the Snipe-IT server that may not be directly accessible from the public internet. The combination of arbitrary file reads and SSRF creates a severe security regression in versions before 8.7.0, necessitating immediate remediation to prevent unauthorized credential harvesting and internal reconnaissance."
}