CVE-2026-86745: Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export
Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the code was never included in a tagged release), SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report (GET /admin/settings/location-scoping-report.csv) through a bare fputcsv() call without applying League\Csv\EscapeFormula, unlike the other CSV exports which honor config('app.escapeformulas'). An authenticated user with ordinary create/edit rights can place a spreadsheet formula in free-text fields that appear in the report (item name, asset tag, serial, item or location company name, location name) and arrange for the record to be FMCS-mismatched so it is included in the export. When a superuser downloads the report and opens it in Excel, LibreOffice Calc, or Google Sheets with formula evaluation enabled and external-content warnings dismissed or disabled, cells beginning with =, +, -, @, tab, or CR are executed in the victim's spreadsheet context, enabling data exfiltration (e.g., HYPERLINK/WEBSERVICE) or, on Windows Excel, legacy DDE command execution. This issue is fixed in version 8.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.7.0 - Compensating control
For users who download and open the location-scoping CSV report, open it with formula evaluation disabled and keep external-content warnings enabled (e.g., do not dismiss prompts in Excel/LibreOffice/Google Sheets) to prevent execution of cells beginning with =, +, -, @, tab, or CR.
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects master-branch builds after 8.6.3 where the location-scoping report code is present. The vulnerable code was never included in a tagged release, and the issue is fixed in 8.7.0.
What access does an attacker need?
An attacker needs an authenticated account with ordinary create or edit rights. They must be able to place formula text in a reportable free-text field and cause the relevant record to be FMCS-mismatched so it appears in the location-scoping export.
What user action is required for exploitation?
A superuser must download the location-scoping CSV report and open it in Excel, LibreOffice Calc, or Google Sheets with formula evaluation enabled. External-content warnings must also be dismissed or disabled for external-content-based payloads.
Which fields can carry a malicious formula in this report?
The affected report can include item name, asset tag, serial, item company name, location company name, and location name. Formula execution can be triggered by values beginning with =, +, -, @, a tab character, or a carriage return.
What can be done before upgrading?
Avoid downloading and opening the location-scoping mismatch CSV from affected master-branch builds, especially in spreadsheet applications that evaluate formulas. Limit ordinary users' ability to create or edit records containing untrusted free-text values where possible.