CVE-2026-86742

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description An issue exists where formula elements are not neutralized in the unaccepted assets acceptance report CSV export. The postAssetAcceptanceReport() function in ReportsController manually constructs the CSV without applying formula escaping or honoring the app.escape formulas configuration. An authenticated user with low privileges can inject values starting with =, +, -, @, tab, or CR into free-text fields such as asset name, tag, company name, category, model, or assignee display name. When a user with reports.view privileges requests the export via the 'POST /reports/unaccepted assets' endpoint and opens the file in spreadsheet software like Excel, LibreOffice Calc, or Google Sheets, the injected content is executed as a formula. This can lead to data exfiltration through functions like HYPERLINK or WEBSERVICE, or DDE (Dynamic Data Exchange) command execution on legacy Windows Excel configurations.

Recommendations Update to version 8.7.0.