Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML() function. Attackers can craft a malicious employee_num value containing an img tag with an arbitrary HTTP(S) URL to trigger server-side requests to internal services, cloud metadata endpoints, or external targets when a victim signs an asset acceptance.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 HIGH: CVE-2026-86771 (CVSS 7.6) - Snipe-IT <8.7.0 vulnerable to SSRF via PDF generator. Attackers w/ users[.]edit permission can inject img tags to access internal services & cloud metadata. Patch immediately. #CVE #PatchNow https://t.co/5I5YeCxi18
Post summary
The tweet announces a high‑severity SSRF vulnerability in Snipe‑IT and urges users to immediately apply the vendor’s patch.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | snipeitapp | snipe-it | - | - | - |