CVE-2026-86745 in Snipe-IT
Summary
by MITRE • 09/09/2026
Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the code was never included in a tagged release), SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report (GET /admin/settings/location-scoping-report.csv) through a bare fputcsv() call without applying League\Csv\EscapeFormula, unlike the other CSV exports which honor config('app.escape_formulas'). An authenticated user with ordinary create/edit rights can place a spreadsheet formula in free-text fields that appear in the report (item name, asset tag, serial, item or location company name, location name) and arrange for the record to be FMCS-mismatched so it is included in the export. When a superuser downloads the report and opens it in Excel, LibreOffice Calc, or Google Sheets with formula evaluation enabled and external-content warnings dismissed or disabled, cells beginning with =, +, -, @, tab, or CR are executed in the victim's spreadsheet context, enabling data exfiltration (e.g., HYPERLINK/WEBSERVICE) or, on Windows Excel, legacy DDE command execution. This issue is fixed in version 8.7.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified involves a critical server-side template injection and cross-site scripting variant within the Snipe-IT IT asset management application, specifically affecting master branch builds after version 8.6.3 which were never included in an official tagged release. The core technical flaw resides in the SettingsController::downloadLocationScopingReport method, which handles the generation of CSV reports for FMCS location-scoping mismatches via the endpoint GET /admin/settings/location-scoping-report.csv. Unlike other CSV export functionalities within the application that correctly utilize the League\Csv\EscapeFormula helper to sanitize input data based on the app.escape_formulas configuration setting, this specific report stream bypasses these protections by using a bare fputcsv() call directly. This inconsistency creates a significant security gap where user-controlled input is written to a CSV file without proper escaping of characters that are interpreted as formula delimiters or commands by spreadsheet applications.
An authenticated attacker with standard create and edit privileges can exploit this flaw by injecting malicious content into free-text fields such as item names, asset tags, serial numbers, company names associated with items or locations, and location names. The attack requires the adversary to manipulate data in a way that triggers an FMCS-mismatch condition, ensuring the crafted record is included in the generated report. By entering values starting with characters like equals signs, plus signs, hyphens, at symbols, tabs, or carriage returns, the attacker embeds executable spreadsheet formulas directly into the CSV structure. When a privileged user, such as a superuser, downloads this compromised CSV file and opens it in common spreadsheet software including Microsoft Excel, LibreOffice Calc, or Google Sheets with formula evaluation enabled, the malicious content is executed within the victim's local environment.
The operational impact of this vulnerability extends beyond simple data corruption to severe security breaches involving data exfiltration and remote code execution on specific platforms. If a user opens the file in an application that supports external service calls, formulas such as HYPERLINK or WEBSERVICE can be triggered to send sensitive internal data from the Snipe-IT instance to an attacker-controlled server. On Windows systems using Microsoft Excel, the vulnerability is particularly dangerous because it allows for legacy Dynamic Data Exchange DDE command execution when users dismiss or disable external content warnings. This capability enables arbitrary code execution on the victim's machine, potentially leading to full system compromise depending on the privileges of the user running the spreadsheet application.
This issue aligns with CWE-79 Cross-site Scripting and CWE-116 Improper Encoding or Escaping of Output, specifically regarding CSV injection techniques often referred to as Formula Injection. From a threat modeling perspective using MITRE ATT&CK frameworks, this vulnerability facilitates Initial Access through social engineering tactics where an attacker tricks a privileged user into opening a malicious file, followed by Execution via DDE commands and Collection for data exfiltration. The lack of consistent application-level sanitization across different export features highlights a systemic weakness in input validation strategies within the codebase prior to the fix.
The vulnerability has been addressed in version 8.7.0 of Snipe-IT through the implementation of proper escaping mechanisms similar to those used in other parts of the application. Organizations running affected versions should immediately upgrade to the patched release or apply manual mitigations if upgrading is not feasible. Mitigation strategies include ensuring that all CSV exports utilize consistent sanitization libraries like League\Csv\EscapeFormula, disabling automatic formula evaluation in spreadsheet applications through group policies or user education, and restricting access to sensitive report generation endpoints to only those users who strictly require it for their job functions. Regular security audits of export functionalities are recommended to prevent similar inconsistencies from arising in future development cycles.