CVE-2026-86749 describes a vulnerability in Snipe-IT (<= 8.6.3) where the application does not verify the success of storage write and delete operations in ImageUploadRequest::handleImages(). Laravel's default disk mode does not throw exceptions on storage failures, so a failed Storage::disk('public')->put(...) call can silently fail, leading to deletion of the previous image and reassignment of the model's image reference to a non-existent file. Similarly, a failed Storage::delete() call still nulls the model's image field, orphaning files on disk. This condition arises during transient storage backend failures such as S3 network errors, filesystem permission issues, or quota exhaustion, triggered by legitimate authenticated user image uploads. The vulnerability affects all models routed through ImageUploadRequest::handleImages, including assets, users, companies, and others. The issue was fixed in Snipe-IT version 8.7.0.

The vulnerability can cause unrecoverable loss of previously stored images and persistent inconsistencies between the database and storage disk. This can disrupt asset management and related functionalities relying on image data. The problem is triggered by transient storage failures during legitimate image uploads by authenticated users, not by direct attacker control. There is no indication of remote code execution or data disclosure. Known exploits in the wild are not reported.

A patch is available in Snipe-IT version 8.7.0 that fixes this issue. Users should upgrade to version 8.7.0 or later to resolve the vulnerability. Since this is a cloud service, the vendor typically manages remediation server-side; verify with the vendor advisory for confirmation. Until patched, manual reconciliation of orphaned files and database inconsistencies may be required if storage failures occur during image uploads.