CVE-2026-86742

Snipe-IT through 8.6.3 fails to neutralize spreadsheet formula characters in the CSV export for the 'unaccepted assets' acceptance report (ReportsController::postAssetAcceptanceReport), which builds the CSV manually and skips the League\Csv\EscapeFormula protection used by the controller's six other exports. A low-privileged authenticated user who can edit any record feeding the report (asset name/tag, company, category, model, or assignee display name) can store a value beginning with =, +, -, @, tab, or CR; when a user with reports.view rights exports the report and opens it in Excel, LibreOffice Calc, or Google Sheets, the payload is evaluated in the downloader's context. Successful exploitation enables data exfiltration via formulas such as HYPERLINK or WEBSERVICE, and potentially command execution via DDE on legacy Windows Excel configurations. The issue affects self-hosted Snipe-IT deployments up to and including 8.6.3 and is fixed in 8.7.0. It has a public advisory (GHSA-w4xq-9p85-4qmv) but no evidence of exploitation in the wild, consistent with a low EPSS score of 0.3%.

What to do: Upgrade Snipe-IT to 8.7.0 or later, where formula escaping is applied to the acceptance report export. Until patched, restrict reports.view privileges and the POST /reports/unaccepted_assets endpoint, audit free-text fields (asset name/tag, company, category, model, assignee name) for leading =, +, -, @, tab, or CR characters, and instruct users to open exported CSVs in a plain-text editor or with automatic formula evaluation and DDE disabled in Excel.