CVE-2026-55452

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.5.0

Description An issue exists where the Actionlog::logaction() function stores the request User-Agent header, and the ReportsController::postActivityReport() function writes this value to the Activity Report CSV without formula escaping. This allows a low-privileged authenticated user to store a formula-like User-Agent that may execute when a report viewer opens the exported CSV in spreadsheet software. This is a CSV injection, which occurs when untrusted input is inserted into a CSV file and executed as a formula by spreadsheet applications.

Recommendations Update to version 8.5.0.