Snipe-IT has CSV formula injection in Activity Report export

CAO 7.3CVE-2026-55452 · GHSA-whrx-mmgr-gpcf · Công bố 10/07/2026 · cập nhật 25/10/2026

Tóm tắt nhanh

CVE-2026-55452 là lỗ hổng mức CAO (CVSS 7.3) ảnh hưởng snipe/snipe-it, snipe-it (snipeitapp).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.43%, cao hơn 36.8% các lỗ hổng khác.
Cách xử lý: cập nhật lên 8.6.2, 8.5.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
snipe/snipe-it Packagist	`< 8.6.2`	`8.6.2`
snipe-it snipeitapp	`< 8.5.0`	`8.5.0`

Mô tả

Impact

In Snipe-IT v8.6.1 and lower, Actionlog::logaction() stores the request User-Agent header in user_agent. That value is later included in the Activity Report CSV export by ReportsController::postActivityReport() and written with plain fputcsv().

A low-privileged authenticated user can set a formula-like User-Agent, perform a logged action, and have that value stored in the activity log. If an admin or report viewer later exports the Activity Report and opens it in spreadsheet software, the formula may execute.

Example payload:

User-Agent: =HYPERLINK("https://example.com/","click")

Mô tả của NVD

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActivityReport() writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged authenticated user to store a formula-like User-Agent that may execute when a report viewer opens the exported CSV in spreadsheet software. This issue is fixed in version 8.5.0.