CVE-2026-86741 affects Snipe-IT prior to version 8.7.0. The vulnerability arises because the category EULA text field is not properly sanitized before inclusion in checkout confirmation emails. Attackers with low privileges can inject markdown image syntax or raw HTML img tags referencing local files or remote URLs. The mail auto-embed library processes these references server-side, embedding the referenced files as email attachments. This behavior can be exploited to exfiltrate sensitive server files, including environment configuration files containing credentials, and to perform SSRF attacks.

An attacker with low-privilege access can exploit this vulnerability to cause the server to read and embed sensitive local files into outgoing emails, leading to potential disclosure of confidential information such as environment variables and credentials. Additionally, the vulnerability enables SSRF attacks, which may allow attackers to interact with internal systems or services not otherwise accessible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict low-privilege user input in the category EULA text field and disable or limit the mail auto-embed functionality if possible to prevent automatic embedding of external or local resources.