CVE-2026-86748
Low
No strong exploitation signal.
CVSS base
6.1
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H
EPSS — probability of exploitation (30 days)
0.3%
24.0th percentile
CISA KEV
Not listed
Weakness / dates
CWE-460
Published 2026-09-09 · modified 2026-09-14
CVSS breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H
| Attack Vector | N | Network |
| Attack Complexity | L | Low |
| Privileges Required | H | High |
| User Interaction | R | Required |
| Scope | U | Unchanged |
| Confidentiality | N | None |
| Integrity | H | High |
| Availability | H | High |
Timeline
- 2026-09-09 — Published (NVD)
- 2026-09-14 — Last modified (NVD)
Description
Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism.