CVE-2026-86745 Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...

CVE-2026-86742 Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

CVE-2026-86742

Snipe-IT versions through 8.6.3 are vulnerable to CSV formula injection via the unaccepted assets acceptance report export. The ReportsController::postAssetAcceptanceReport method builds the CSV by hand without applying League\Csv\EscapeFormula or honoring the app.escape_formulas config, unlike s...

CVE-2026-86742: Improper Neutralization of Formula Elements in a CSV File

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

PT-2026-89011

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

CVE-2026-86745: Improper Neutralization of Formula Elements in a CSV File

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...