CVE-2026-86745

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...

EUVD-2026-74922

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...

CVE-2026-86745 Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...

CVE-2026-86745

Snipe-IT (IT asset management) master-branch builds after 8.6.3 are vulnerable to CSV Formula Injection in the Location-Scoping Export. The SettingsController::downloadLocationScopingReport endpoint (GET /admin/settings/location-scoping-report.csv) streams data through a bare fputcsv() call witho...