Snipe-IT unauth RCE via file upload (CVE-2026-37709)

Patch now - CVE-2026-37709 is a critical insecure-permissions vulnerability in Snipe-IT v.8.4.0 and earlier that grants unauthenticated remote code execution via the file upload API. Patched in the March 10, 2026 commit 676a9958 - update immediately.

Overview

CVE-2026-37709 affects the app/Http/Controllers/Api/UploadedFilesController.php component in the Snipe-IT asset management application. The insecure permissions allow any remote attacker on the network to upload and execute arbitrary files on the server without authentication, exploiting low-complexity conditions with no user interaction required.

Impact

A successful exploit gains the attacker full remote code execution (RCE) on the server hosting Snipe-IT. The CVSS 9.8 critical rating reflects the network-based attack vector, no privileges needed, and the complete compromise of confidentiality, integrity, and availability (CIA triad). Since Snipe-IT often runs on internal networks, a compromised server can serve as a pivot point for lateral movement to other systems.

Remediation and Mitigation

Patch: Upgrade to the patched version by pulling the latest commit (676a9958 post-March 10, 2026). If using Docker, rebuild with: docker pull snipe/snipe-it:latest and restart containers. For source installations, run git pull from the application root directory and verify git log shows the fix commit.

Mitigation (if immediate patching is not possible): Restrict network access to the /api/v1/uploaded-files endpoint via web application firewall (WAF) rules or network ACLs until the patch is applied. Remove write permissions from the uploads directory for the web server user.

Security Insight

This vulnerability continues a troubling pattern in PHP-based asset management tools: overly permissive file upload handlers that skip authentication checks. Snipe-IT’s API architecture appears to have separated the upload controller from standard authorization middleware, a common oversight when adding feature endpoints to legacy codebases. Organizations running such tools should review all API routes for missing middleware, particularly file upload and configuration endpoints. For more details, see our data breach reports and security news for related advisories.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs