GitHub Advisoryadvisory · Packagist

GHSA-whrx-mmgr-gpcf Snipe-IT has CSV formula injection in Activity Report export

MEDIUM Published 2026-08-28 Modified 2026-08-28 Official page ↗
Aliases
CVE-2026-55452
Ecosystem
Packagist
Packages
snipe/snipe-it
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-1236
Reviewed
2026-08-28

Affected packages

• Packagist snipe/snipe-it: < 8.6.2 → fixed in 8.6.2

Description

Impact In Snipe-IT v8.6.1 and lower, `Actionlog::logaction()` stores the request User-Agent header in user_agent. That value is later included in the Activity Report CSV export by `ReportsController::postActivityReport()` and written with plain `fputcsv()`. A low-privileged authenticated user can set a formula-like User-Agent, perform a logged action, and have that value stored in the activity log. If an admin or report viewer later exports the Activity Report and opens it in spreadsheet software, the formula may execute. Example payload: `User-Agent: =HYPERLINK("https://example.com/","click")`

Related

Alias · CVE (1)

  • CVE-2026-55452 Snipe-IT is an IT asset/license management system. vulnerability

Weakness · CWE (1)

  • CWE-1236 Improper Neutralization of Formula Elements in a CSV File weakness

References