CVE-2026-86733 is an OS command injection vulnerability in grokability's Snipe-IT product affecting versions before 8.7.0. The vulnerability arises because the application streams SQL entries from uploaded backup archives directly into the MySQL/MariaDB command-line client without using the --binary-mode flag. This omission causes the client to interpret lines starting with backslash commands (e.g., \!) as local shell commands. An authenticated superadministrator can exploit this by uploading a specially crafted ZIP backup and restoring it without the optional 'clean' sanitizer parameter, which is disabled by default (DB_SANITIZE_BY_DEFAULT is false). This allows execution of arbitrary OS commands as the web application's operating system user, potentially exposing sensitive application secrets such as database credentials and APP_KEY, and enabling modification of writable files and data. The issue is fixed in version 8.7.0 by adding the --binary-mode flag to the MySQL client invocation.

An attacker with superadministrator authentication privileges can execute arbitrary operating system commands on the server hosting the Snipe-IT application. This can lead to exposure of sensitive application secrets including database credentials and APP_KEY, as well as unauthorized modification of application-writable files and data. The vulnerability requires authenticated access with high privileges and does not involve user interaction. There is no indication of known exploits in the wild at this time.

Upgrade to Snipe-IT version 8.7.0 or later, which includes the --binary-mode flag in the MySQL client invocation to prevent interpretation of backslash commands as shell commands. Until upgrading, avoid restoring backups without the optional 'clean' sanitizer parameter enabled. Since DB_SANITIZE_BY_DEFAULT is false by default, explicitly enabling sanitization during restore operations can mitigate the risk. Monitor vendor advisories for any additional remediation guidance. Patch status is not explicitly confirmed beyond the version 8.7.0 fix; verify with vendor sources.