CVE-2026-86751 affects Snipe-IT before version 8.7.0. The vulnerability arises from improper sanitization of markdown image syntax in note fields, specifically in checkout acceptance notes. Authenticated attackers can submit crafted markdown that survives HTML escaping and is expanded by the CommonMark parser. This expansion causes laravel-mail-auto-embed to invoke file_get_contents or curl on attacker-controlled paths, enabling reading of arbitrary server files and issuing server-side HTTP requests. Sensitive files like the .env file containing the APP_KEY can be exfiltrated, posing a significant confidentiality risk.

An attacker with authentication privileges can read arbitrary files on the server and perform server-side HTTP requests. This can lead to exposure of sensitive configuration files, including .env files that contain critical secrets such as the APP_KEY. The vulnerability has a high severity score (CVSS 8.4), indicating a serious risk to confidentiality and partial impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to note fields to trusted users only and monitor for suspicious activity related to markdown image syntax usage. Avoid using markdown image syntax in untrusted input fields. Follow vendor updates closely for an official fix or temporary mitigation.