External risk intelligence

Snipe-IT Authenticated Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2025-63601

Snipe-IT is a widely deployed IT asset management platform typically hosted as a web application. As a web-based service managing internal infrastructure, it is frequently exposed to the network or internet to allow access for administrators and employees. Given its role as a centralized web interface for asset tracking, it represents a common, reachable web-based attack surface in many deployment environments.

Unrestricted File Upload

Snipeitapp Snipe It

before 8.3.3

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Snipe-IT asset management system allows an authenticated user to upload malicious files and execute commands, potentially leading to significant compromise. This type of software is often used to track an organization's technology assets, making it a critical component of IT infrastructure. The main concern is confirming relevance and exposure within our environment.

Allows attackers to run commands on our systems.
Critical for managing IT assets; a key target.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with existing credentials can exploit this vulnerability by uploading a specially crafted backup file. This file can contain arbitrary files, ultimately leading to the execution of system commands.

Authenticated access to the application is required.
Uploading a malicious backup file triggers the vulnerability.
Remote code execution, leading to system compromise.

Live Threat

Current exploitation, exposure, and threat context

An authenticated attacker could upload a malicious backup file to execute system commands and potentially upload arbitrary files when the system is supported. This could affect the confidentiality, integrity, and availability of the system.

System commands and arbitrary files.
Uploading a crafted backup file.
System compromise and data loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

The application owners and infrastructure teams are likely responsible for addressing this vulnerability in Snipe-IT. The first step is to identify all instances of Snipe-IT, confirm their reachability and business criticality, and then assign ownership for remediation planning.

Application owners should drive remediation.
Verify system reachability and business impact.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Snipe-IT and how is it used?

Snipe-IT is an IT asset management platform designed to help organizations track hardware, software licenses, and consumables. It provides a centralized web-based interface for managing the lifecycle of technology equipment. Because it stores sensitive inventory data, it is a foundational tool for IT departments to maintain oversight of their technical infrastructure.

What does CWE-434 mean regarding CVE-2025-63601?

CWE-434 refers to an Unrestricted Upload of File with Dangerous Type vulnerability. In the context of CVE-2025-63601, this means the software does not sufficiently restrict the types of files a user can upload. An attacker can leverage this weakness to upload a malicious backup file that the system incorrectly processes, eventually allowing them to run unauthorized commands on the underlying server.

How is this Snipe-IT vulnerability triggered?

The vulnerability requires an attacker to already have valid credentials for the Snipe-IT application. Once authenticated, the attacker triggers the issue by uploading a specially crafted backup file. It is important to note that actions performed by unauthenticated users or uploading standard, non-malicious files do not activate this specific remote code execution path.

Is my Snipe-IT instance at risk?

According to Halo Surface Signal, Snipe-IT is frequently deployed as a web-accessible application to support administrative workflows, which often places it on reachable network segments. If your instance is accessible over the internet or a wide internal network, it faces a higher degree of potential interaction, making it essential to prioritize verifying your current version.

What should I do if I run Snipe-IT?

First, perform an inventory to locate all instances of Snipe-IT within your environment and check if they are running a version prior to 8.3.3. Once identified, work with your infrastructure or application owners to verify their network reachability and business criticality. Planning an upgrade to version 8.3.3 or later is the primary path to removing the vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.