CVE-2026-55452: Snipe-IT XSS Vulnerability

CVE-2026-55452 Overview

Snipe-IT is an open-source IT asset and license management system used by organizations to track hardware, software, and licenses. A CSV formula injection vulnerability affects versions prior to 8.5.0. The Actionlog::logaction() function stores the incoming request User-Agent header, and ReportsController::postActivityReport() writes that value directly into the Activity Report CSV without formula escaping. A low-privileged authenticated user can inject a formula-like User-Agent string that executes when a report viewer opens the exported CSV in spreadsheet software such as Microsoft Excel or LibreOffice Calc. The issue is fixed in version 8.5.0.

Critical Impact
An authenticated attacker can plant malicious spreadsheet formulas that execute in the context of any administrator who exports and opens the Activity Report CSV, enabling data exfiltration or arbitrary command execution through spreadsheet features.

Affected Products

Snipe-IT versions prior to 8.5.0
Snipe-IT Activity Report CSV export component
Snipe-IT ReportsController::postActivityReport() and Actionlog::logaction() handlers

Discovery Timeline

2026-07-10 - CVE-2026-55452 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-55452

Vulnerability Analysis

The vulnerability is a CSV formula injection flaw classified under [CWE-1236] (Improper Neutralization of Formula Elements in a CSV File). Snipe-IT logs the User-Agent header from incoming HTTP requests through Actionlog::logaction() and persists it to the database. When an administrator later exports the Activity Report, ReportsController::postActivityReport() writes the stored User-Agent value into a CSV row without escaping cell contents that begin with formula-triggering characters such as =, +, -, @, tab, or carriage return.

When the CSV is opened in a spreadsheet application, characters at the start of a cell are interpreted as a formula rather than plain text. This enables an attacker to embed expressions that reference external resources, exfiltrate cell data through hyperlink requests, or invoke dynamic data exchange (DDE) handlers on legacy configurations.

Root Cause

Snipe-IT relied on default CSV writing behavior without applying the League\Csv\EscapeFormula filter to fields derived from user-controlled input. The activity report code path passed raw log values to the streamed CSV writer, so any User-Agent string beginning with a formula character was written verbatim.

Attack Vector

Exploitation requires authenticated access with the minimal privileges needed to trigger an action log entry. The attacker sets a malicious User-Agent header when performing any tracked action, such as browsing an asset page. The payload persists in the activity log until an administrator exports the Activity Report and opens the resulting CSV file, at which point the spreadsheet application evaluates the payload.

php

// Security patch in app/Http/Controllers/ReportsController.php
// Source: https://github.com/grokability/snipe-it/commit/7b7d2c87fbc965a7933b1bf9e3f2c331b8c8e19c

$response = new StreamedResponse(function () {
    Log::debug('Starting streamed response');
    Log::debug('CSV escaping is set to: '.config('app.escape_formulas'));

    // Open output stream
    $handle = fopen('php://output', 'w');

The companion change in app/Http/Controllers/Licenses/LicensesController.php imports League\Csv\EscapeFormula so that additional report writers apply formula escaping to untrusted cell contents.

Detection Methods for CVE-2026-55452

Indicators of Compromise

HTTP requests to Snipe-IT with User-Agent header values beginning with =, +, -, @, \t, or \r
Activity log rows containing User-Agent strings that start with spreadsheet formula characters or reference external functions such as HYPERLINK, WEBSERVICE, IMPORTXML, or cmd|
Outbound network requests from administrator workstations to unfamiliar hosts shortly after opening an exported Activity Report CSV

Detection Strategies

Query the Snipe-IT action_logs table for records where the stored user_agent field starts with a formula-trigger character
Inspect web server access logs for anomalous User-Agent headers that contain =, +, @, or spreadsheet function names
Correlate CSV export events with subsequent process launches or network connections on administrator hosts

Monitoring Recommendations

Alert on Snipe-IT report download events performed by administrator accounts and track downstream file open activity
Monitor endpoints that consume exported CSVs for spreadsheet processes spawning child processes such as cmd.exe, powershell.exe, or bash
Log and review any User-Agent value stored in application databases that fails standard token character validation

How to Mitigate CVE-2026-55452

Immediate Actions Required

Upgrade Snipe-IT to version 8.5.0 or later, which applies League\Csv\EscapeFormula across affected report writers
Set the APP_ESCAPE_FORMULAS environment variable to true to activate formula escaping across CSV exports
Audit historical action_logs entries for User-Agent values beginning with formula-trigger characters and sanitize or purge them before re-exporting reports

Patch Information

The fix is delivered in the Snipe-IT v8.5.0 release and the remediation commit 7b7d2c87. The patch imports League\Csv\EscapeFormula into the reports and licenses controllers and honors the app.escape_formulas configuration flag when streaming CSV output. Full advisory details are published in the GitHub Security Advisory GHSA-whrx-mmgr-gpcf.

Workarounds

Open exported CSVs in a text editor to review contents before loading them in a spreadsheet application
Configure spreadsheet clients to disable automatic formula evaluation, external data connections, and DDE handlers for imported files
Restrict who can generate the Activity Report and consume the output only on hardened administrator workstations until the upgrade is applied

bash

# Configuration example: enable formula escaping in Snipe-IT .env
APP_ESCAPE_FORMULAS=true