Description

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded by CommonMark parser, and resolved by laravel-mail-auto-embed via file_get_contents or curl, exfiltrating sensitive files like .env containing APP_KEY.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-09-09T14:17:24.170Z",
  "pubdate": "2026-09-09T14:17:24.170Z",
  "executiveSummary": "This vulnerability involves an improper sanitization flaw within Snipe-IT (prior to version 8.7.0) regarding markdown image syntax processing in note fields.\nThe vulnerability allows an authenticated attacker to perform Server-Side Request Forgery (SSRF) and arbitrary Local File Inclusion (LFI).\nBy submitting malicious markdown image syntax, attackers can bypass HTML escaping mechanisms, leading the server to process arbitrary file paths or URLs.\nSuccessful exploitation enables the exfiltration of sensitive configuration files, such as the .env file containing the APP_KEY, which could lead to full application compromise.\nThe vulnerability is restricted to authenticated users but grants significant unauthorized access to the underlying server's filesystem and networking capabilities.\nThis represents a high-risk security flaw as it facilitates data exfiltration and potential remote code execution pathways through the leakage of cryptographic keys and environment credentials.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient sanitization of user-supplied markdown inputs within Snipe-IT note fields, specifically during the handling of image syntax (e.g., ![alt](source)).\nWhile Snipe-IT employs standard HTML escaping, the CommonMark parser used by the application fails to adequately neutralize markdown-specific image syntax before it is processed by the backend.\nThe vulnerability is triggered when the application utilizes the laravel-mail-auto-embed library to process these notes. The library attempts to resolve the sources defined in the markdown image tags via file_get_contents() for local file retrieval or cURL for external HTTP requests.\nThe attack flow proceeds as follows: First, an authenticated attacker crafts a payload utilizing markdown image syntax where the image source points to a local system file path (e.g., file:///etc/passwd or .env) or an external URL. Second, the attacker submits this payload via the checkout acceptance notes field. Third, the application's backend processes the markdown, and the laravel-mail-auto-embed component inadvertently interprets the embedded path or URL.\nIf a local file path is provided, the function performs a read operation on the sensitive file, subsequently attempting to embed the file contents into an outgoing email or notification. If an external URL is provided, the server acts as a proxy, initiating an HTTP request to the specified target, thereby achieving SSRF.\nThis behavior exposes sensitive internal configuration data, such as the APP_KEY stored in the .env file. The exposure of the APP_KEY is critical as it can be leveraged to forge session cookies, bypass authentication, or decrypt sensitive data stored within the database.\nThe vulnerability affects all versions of Snipe-IT prior to 8.7.0 and requires valid user credentials to initiate the injection, though it does not necessitate administrative privileges, significantly expanding the threat surface."
}