CVE-2026-55474 describes a relative path traversal vulnerability (CWE-23) in the grokability Snipe-IT product. The vulnerability exists because the ActionlogController::displaySig method concatenates the route filename parameter directly into a private upload-directory path without sanitization. This flaw enables an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process. The vulnerability affects all versions prior to 8.5.0, where it has been fixed.

An authenticated attacker can exploit this vulnerability to read arbitrary files on the server that the web server process has access to. This could lead to exposure of sensitive information stored on the server. There is no indication of remote code execution or privilege escalation from the provided data.

Upgrade Snipe-IT to version 8.5.0 or later, where this vulnerability has been fixed. No other official remediation or temporary fix is indicated. Patch status is confirmed by the vendor stating the issue is fixed in 8.5.0.