THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-86749 (MEDIUM 6.3) — Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in ImageUploadRequest::handleImages(). Because Laravel's default disk mode does not throw on failure, a silently failed Storage::disk('public')->put(...) call still caused the ap

[NVD] CVE-2026-86749 (MEDIUM 6.3) — Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in ImageUploadRequest::handleImages(). Because Laravel's default disk mode does not throw on failure, a silently failed Storage::disk('public')->put(...) call still caused the ap

mednvdPublished 2026-09-09

CVE-2026-86749 CVSS: 6.3 MEDIUM Published: 2026-09-09T14:17:23.880

Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in ImageUploadRequest::handleImages(). Because Laravel's default disk mode does not throw on failure, a silently failed Storage::disk('public')->put(...) call still caused the application to delete the previous image via deleteExi

Indicators of compromise

CVE-2026-86749cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-86749