CVE-2026-86733: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in grokability snipe-it

Snipe-IT versions prior to 8.7.0 allow an authenticated superadministrator to perform OS command injection via the backup restore functionality. The vulnerability arises because the SQL entry from an uploaded backup archive is streamed directly into the MySQL/MariaDB command-line client without the --binary-mode flag. This omission causes the client to interpret lines starting with backslash commands (e.g., \!) as local shell commands. An attacker can exploit this by uploading a specially crafted ZIP backup and restoring it without the optional 'clean' sanitizer parameter, which is not enabled by default. Successful exploitation allows execution of arbitrary OS commands as the web application's OS user, potentially exposing sensitive application secrets such as database credentials and APP_KEY, and enabling modification of application-writable files and data. The issue is resolved in version 8.7.0 by adding the --binary-mode flag to the MySQL client invocation.

An authenticated superadministrator can execute arbitrary operating system commands on the server hosting Snipe-IT, leading to exposure of sensitive application secrets including database credentials and APP_KEY. This also allows modification of application files and data, posing a significant risk to the confidentiality, integrity, and availability of the application environment.

Upgrade Snipe-IT to version 8.7.0 or later, which includes the fix by adding the --binary-mode flag to the MySQL/MariaDB client invocation during backup restore. Until upgraded, avoid restoring backups without the 'clean' sanitizer parameter enabled, although this parameter is not enabled by default. Patch status is confirmed fixed in version 8.7.0.