CVE-2026-86745: Snipe-IT CSV Formula Injection Vulnerability

CVE-2026-86745 Overview

CVE-2026-86745 is a CSV formula injection vulnerability [CWE-1236] in Snipe-IT, an open-source IT asset management application. The flaw affects master-branch builds after version 8.6.3 and is fixed in version 8.7.0. The SettingsController::downloadLocationScopingReport method streams the FMCS location-scoping mismatch report through a bare fputcsv() call. Unlike other CSV exports in the application, this endpoint does not apply League\Csv\EscapeFormula or honor config('app.escape_formulas'). An authenticated user with ordinary create or edit rights can inject spreadsheet formulas into free-text fields that later appear in the export.

Critical Impact
When a superuser downloads the report and opens it in a spreadsheet application with formula evaluation enabled, injected formulas execute in the victim's context, enabling data exfiltration or legacy DDE command execution on Windows Excel.

Affected Products

Snipe-IT master-branch builds after 8.6.3
Snipe-IT versions prior to 8.7.0
The vulnerable code was never included in a tagged release

Discovery Timeline

2026-09-09 - CVE-2026-86745 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86745

Vulnerability Analysis

The vulnerability resides in the FMCS location-scoping mismatch report exported via GET /admin/settings/location-scoping-report.csv. The SettingsController::downloadLocationScopingReport method writes rows directly using PHP's fputcsv() without sanitizing leading formula characters. Other CSV export routes in Snipe-IT wrap output through League\Csv\EscapeFormula and respect the app.escape_formulas configuration flag, but this endpoint bypasses those safeguards.

An authenticated attacker with basic create or edit permissions can plant payloads in free-text fields including item name, asset tag, serial number, item or location company name, and location name. The attacker then arranges for the record to trigger an FMCS mismatch so it appears in the report. When a superuser downloads the CSV and opens it in Excel, LibreOffice Calc, or Google Sheets with formula evaluation active, cells beginning with =, +, -, @, tab, or carriage return are interpreted as formulas.

Root Cause

The root cause is missing formula-character escaping in a single CSV export path. The developer used fputcsv() directly instead of the project's standard League CSV escape wrapper, breaking consistency with the rest of the codebase and creating a gap in defense-in-depth against spreadsheet formula injection.

Attack Vector

Exploitation requires an authenticated low-privilege account and a superuser who downloads and opens the report with formula evaluation enabled and external-content warnings dismissed. Payloads such as HYPERLINK or WEBSERVICE can exfiltrate data to attacker-controlled hosts. On Windows Excel, legacy Dynamic Data Exchange (DDE) syntax can execute arbitrary commands in the victim's session. The vulnerability chains a stored injection with a client-side execution primitive in the spreadsheet application.

No verified exploit code is publicly available. See the GitHub Security Advisory GHSA-79jf-ppgj-5cc3 and the Vulncheck Advisory for full technical context.

Detection Methods for CVE-2026-86745

Indicators of Compromise

Snipe-IT asset records where free-text fields (item name, asset tag, serial, company name, location name) begin with =, +, -, @, tab, or carriage return.
Access log entries showing GET /admin/settings/location-scoping-report.csv requests correlated with subsequent outbound DNS or HTTP requests from analyst workstations.
Spreadsheet application child processes such as cmd.exe or powershell.exe spawned by excel.exe on workstations that opened the exported report.

Detection Strategies

Audit the Snipe-IT database for records whose free-text fields start with formula trigger characters, focusing on assets modified by non-superuser accounts.
Monitor web server logs for downloads of /admin/settings/location-scoping-report.csv and correlate with the downloading user's activity.
Alert on unusual process ancestry from Microsoft Office applications, particularly Excel spawning shells or network utilities.

Monitoring Recommendations

Enable endpoint telemetry that captures parent-child process relationships from Office applications on administrator workstations.
Log and review all create and edit operations against Snipe-IT asset, location, and company records for anomalous input patterns.
Track egress traffic from workstations that recently opened Snipe-IT CSV exports for connections to unfamiliar external domains.

How to Mitigate CVE-2026-86745

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later, which applies League\Csv\EscapeFormula to the location-scoping report export.
Audit existing records for injected formula characters in free-text fields and sanitize or remove suspicious entries before performing exports.
Instruct superusers to open Snipe-IT CSV exports only in applications with formula evaluation disabled or in a text editor until patching is complete.

Patch Information

The issue is fixed in Snipe-IT 8.7.0. The fix routes the location-scoping report through the same League\Csv\EscapeFormula wrapper used by other CSV exports, honoring the app.escape_formulas configuration flag. Full details are available in the GitHub Security Advisory GHSA-79jf-ppgj-5cc3.

Workarounds

Restrict which accounts can create or edit assets, locations, and companies to trusted personnel until the upgrade is deployed.
Disable automatic formula evaluation in the spreadsheet applications used to open Snipe-IT reports, or open exports in a plain text editor.
Configure Excel and LibreOffice to enforce external-content and DDE warnings, and do not disable Protected View for downloaded files.

bash

# Configuration example: enforce formula escaping in Snipe-IT .env
APP_ESCAPE_FORMULAS=true