CVE-2026-86742

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand (stripping commas and joining rows manually) and, unlike the six sibling exports in the same controller, never applies League\Csv\EscapeFormula or honors the config('app.escape_formulas') setting. An authenticated low-privilege user with ordinary create/edit rights on any record whose free-text fields appear in the report (asset name/tag, company name, category, model, or assignee display name) can set such a field to a value beginning with =, +, -, @, tab, or CR. When a user with reports.view privileges requests the export (POST /reports/unaccepted_assets) for a pending checkout acceptance referencing the poisoned record and opens the resulting CSV in Excel, LibreOffice Calc, or Google Sheets, the injected content is evaluated as a formula in the downloader's spreadsheet context, enabling data exfiltration (e.g., HYPERLINK/WEBSERVICE) or, on legacy Windows Excel configurations, DDE command execution. Fixed in 8.7.0.

• CWE-1236

• https://github.com/grokability/snipe-it/commit/6976f1215444bcfeda50975a5673e8422bcab4bb
• https://github.com/grokability/snipe-it/security/advisories/GHSA-w4xq-9p85-4qmv
• https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-csv-formula-injection-via-asset-acceptance-report

Published

Sep 9, 2026

Last Modified

Sep 9, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86736snipe-it before 8.7.0 contains an incorrect calculation vuln…4.3
• CVE-2026-86737snipe-it versions before 8.7.0 fail to enforce asset view au…4.3
• CVE-2026-86738Snipe-IT versions before 8.7.0 contain a CSS injection vulne…8.7
• CVE-2026-86739Snipe-IT 8.6.3 and earlier do not check the return value of …3.1
• CVE-2026-86740Snipe-IT before 8.7.0 fails to check the return value of Sto…3.8
• CVE-2026-86741Snipe-IT versions before 8.7.0 fail to sanitize the category…8.5
• CVE-2026-86743Snipe-IT versions before 8.7.0 fail to properly scope asset …5
• CVE-2026-86744Snipe-IT 8.6.3 and earlier (and develop pre-release commits …2.2
• CVE-2026-86745Snipe-IT is an IT asset management application. In Snipe-IT …6.5
• CVE-2026-86746Snipe-IT before 8.7.0 contains an authorization bypass vulne…6.4
• CVE-2026-86747Snipe-IT is an open source IT asset management system. In ve…5.4
• CVE-2026-86748Snipe-IT versions before 8.7.0 wipe the database before vali…6.1