Path Traversal in Snipe-IT /display-sig signature endpoint enables authenticated arbitrary file read (.env / APP_KEY / DB_PASSWORD)

// app/Http/Controllers/ActionlogController.php:29-41 default: $this->authorize('view', Asset::class); $file = config('app.private_uploads').'/signatures/'.$filename; // ^^^^^^^^^ // $filename from URL — NO basename() applied

$contents = file_get_contents($file, false, stream_context_create([ 'http' => ['ignore_errors' => true] ])); return response()->make($contents)->header('Content-Type', $filetype);

1) Attacker holds a valid Snipe-IT session with asset.view permission. 2) Web server passes a path containing decoded slashes to PHP — Apache requires double-encoded %252F (default config); Nginx with default merge_slashes on accepts %2F directly. 3) Target file (e.g. /var/www/html/.env) is readable by the web-process owner.

Disclosure of any file readable by the web user. Highest-impact reads observed in the lab: .env (APP_KEY enables Laravel session-cookie forgery and decryption of encrypted DB fields including 2FA secrets; DB_PASSWORD enables direct MariaDB access), oauth-private.key (forges API tokens for any user), storage/logs/laravel.log (internal stack traces and query data). CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N = 7.7 High.

Add basename() to the URL-derived filename before constructing the file path: $filename = basename($filename); $file = config('app.private_uploads').'/signatures/'.$filename; Apply the same fix to getStoredEula() at ActionlogController.php:57. Vendor PR grokability/snipe-it#18927 applies this fix on master (merged 2026-04-24).