Grokability Snipe-IT up to 8.6.3 CSV Export location-scoping-report.csv downloadLocationScopingReport csv injection

Summaryinfo

A vulnerability identified as critical has been detected in Grokability Snipe-IT up to 8.6.3. Impacted is the function SettingsController::downloadLocationScopingReport of the file /admin/settings/location-scoping-report.csv of the component CSV Export. This manipulation of the argument item name/asset tag/serial/item/location company name/location name causes csv injection. This vulnerability is registered as CVE-2026-86745. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Grokability Snipe-IT up to 8.6.3. Affected by this vulnerability is the function SettingsController::downloadLocationScopingReport of the file /admin/settings/location-scoping-report.csv of the component CSV Export. The manipulation of the argument item name/asset tag/serial/item/location company name/location name with an unknown input leads to a csv injection vulnerability. The CWE definition for the vulnerability is CWE-1236. The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the code was never included in a tagged release), SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report (GET /admin/settings/location-scoping-report.csv) through a bare fputcsv() call without applying League\Csv\EscapeFormula, unlike the other CSV exports which honor config('app.escape_formulas'). An authenticated user with ordinary create/edit rights can place a spreadsheet formula in free-text fields that appear in the report (item name, asset tag, serial, item or location company name, location name) and arrange for the record to be FMCS-mismatched so it is included in the export. When a superuser downloads the report and opens it in Excel, LibreOffice Calc, or Google Sheets with formula evaluation enabled and external-content warnings dismissed or disabled, cells beginning with =, +, -, @, tab, or CR are executed in the victim's spreadsheet context, enabling data exfiltration (e.g., HYPERLINK/WEBSERVICE) or, on Windows Excel, legacy DDE command execution. This issue is fixed in version 8.7.0.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-86745 since 09/08/2026. The exploitation appears to be easy. The attack can be launched remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

By approaching the search of inurl:admin/settings/location-scoping-report.csv it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 8.7.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Grokability

Name

• Snipe-IT

Version

• 8.6.0
• 8.6.1
• 8.6.2
• 8.6.3

Website

• Product: https://github.com/grokability/snipe-it/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion