CVE-2026-55452: Snipe-IT: CSV formula injection in Activity Report export
Impact In Snipe-IT v8.6.1 and lower, Actionlog::logaction() stores the request User-Agent header in useragent. That value is later included in the Activity Report CSV export by ReportsController::postActivityReport() and written with plain fputcsv().
A low-privileged authenticated user can set a formula-like User-Agent, perform a logged action, and have that value stored in the activity log. If an admin or report viewer later exports the Activity Report and opens it in spreadsheet software, the formula may execute.
Example payload:
User-Agent: =HYPERLINK("https://example.com/","click")
Other sources
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActivityReport() writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged authenticated user to store a formula-like User-Agent that may execute when a report viewer opens the exported CSV in spreadsheet software. This issue is fixed in version 8.5.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.2 - Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55452?
The severity of CVE-2026-55452 is medium, rated at 4.8 on the CVSS scale.
What is the impact of CVE-2026-55452?
CVE-2026-55452 allows a low-privileged authenticated user to inject malicious formulas into the Activity Report CSV export.
How do I fix CVE-2026-55452?
To fix CVE-2026-55452, upgrade to Snipe-IT version 8.5.0 or later, where the issue has been addressed.
Who is affected by CVE-2026-55452?
Users of Snipe-IT versions prior to 8.5.0 are affected by CVE-2026-55452.
What system does CVE-2026-55452 pertain to?
CVE-2026-55452 pertains to the Snipe-IT IT asset/license management system.