Stored Formula Injection in Snipe-IT Reports

Executive Summary

CVE-2026-55452 is a CSV formula injection vulnerability in the Snipe-IT asset management system affecting versions 8.6.1 and lower.

The issue occurs because the application stores the User-Agent header from HTTP requests in the activity log without proper sanitization.

When an authenticated user with low privileges sets a formula-like User-Agent (for example, =HYPERLINK("https://example.com/","click")), it gets logged.

If an administrator or report viewer later exports the Activity Report as a CSV and opens it in spreadsheet software like Microsoft Excel or LibreOffice Calc, the embedded formula may execute.

This execution can lead to unintended actions such as making web requests to external servers.

The vulnerability was patched in version 8.6.2 of Snipe-IT.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing a low-privileged authenticated user to inject malicious formulas into CSV reports.

When these reports are exported and opened by administrators or other users in spreadsheet software, the malicious formulas may execute.

Such execution can cause unintended actions, including making unauthorized web requests to external servers, potentially leading to data leakage or further exploitation.

This can compromise the security and integrity of your asset management data and expose your environment to additional risks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the Activity Report CSV exports for formula-like User-Agent entries that may execute when opened in spreadsheet software.

Specifically, look for User-Agent strings in the activity logs that start with characters like '=', '+', '-', or '@', which are typical indicators of CSV formula injection attempts.

You can search the logs or exported CSV files for suspicious User-Agent headers using commands like:

• grep -E 'User-Agent.*^[=+\-@]' activity_log.csv
• grep -E '^(=|\+|\-|@)' exported_report.csv

Additionally, monitoring HTTP request headers for unusual User-Agent values containing formula syntax can help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Snipe-IT to version 8.6.2 or later, where this CSV formula injection vulnerability has been patched.

If upgrading immediately is not possible, enable CSV formula escaping by configuring the application to escape formulas in exported CSV files. This can be done by setting the `CSV_ESCAPE_FORMULAS` configuration in the .env file and ensuring the application uses the `League\Csv\EscapeFormula` class to sanitize CSV exports.

Additionally, restrict low-privileged users from submitting malicious User-Agent headers or limit access to the Activity Report exports to trusted users only.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows a low-privileged authenticated user to inject formula-like content into CSV exports via the User-Agent header, which may execute when opened in spreadsheet software. This could lead to unintended actions such as making web requests to external servers.

While the CVE description and resources do not explicitly mention compliance with standards like GDPR or HIPAA, such a vulnerability could potentially impact compliance by exposing sensitive data or enabling unauthorized data exfiltration through malicious CSV formulas.

Organizations subject to these regulations should consider this vulnerability a risk to data integrity and confidentiality, and apply the patch (version 8.6.2 or later) to mitigate potential compliance issues.

Useful 0 Not Useful 0