CVE-2026-86745

Name of the Vulnerable Software and Affected Versions Snipe-IT versions 8.6.4 through 8.6.x

Description An issue exists in the SettingsController::downloadLocationScopingReport function where the FMCS location-scoping mismatch report is streamed via the '/admin/settings/location-scoping-report.csv' endpoint using a bare fputcsv() call. This process fails to apply LeagueCsvEscapeFormula, ignoring the app.escape formulas configuration. An authenticated user with create or edit permissions can inject spreadsheet formulas into free-text fields such as item name, asset tag, serial, item or location company name, and location name. If a superuser downloads this report and opens it in software like Excel, LibreOffice Calc, or Google Sheets with formula evaluation enabled, cells starting with =, +, -, @, tab, or CR are executed. This can lead to data exfiltration via HYPERLINK or WEBSERVICE functions, or legacy DDE command execution on Windows Excel.

Recommendations Update to version 8.7.0.