CVE-2026-86745

Snipe-IT's FMCS location-scoping mismatch CSV report (GET /admin/settings/location-scoping-report.csv) streams data through a bare fputcsv() call without applying League\Csv\EscapeFormula, unlike every other CSV export in the application which honors the app.escape_formulas setting. An authenticated attacker with ordinary create/edit rights can plant spreadsheet formulas (cells beginning with =, +, -, @, tab, or CR) in free-text fields such as item name, asset tag, serial, company name, or location name, and deliberately arrange for those records to appear FMCS-mismatched so they are included in the export. When a superuser downloads the report and opens it in Excel, LibreOffice Calc, or Google Sheets with formula evaluation enabled and external-content warnings dismissed, the payload executes in the victim's spreadsheet context, enabling data exfiltration (e.g., HYPERLINK/WEBSERVICE) or, on Windows Excel, legacy DDE command execution. Only unreleased master-branch builds after 8.6.3 contain the vulnerable code — it was never shipped in a tagged release — and the flaw is fixed in version 8.7.0. No exploitation in the wild is known; the vendor's GHSA-79jf-ppgj-5cc3 advisory is public, EPSS is 0.4% (36th percentile), and the issue is not in the CISA KEV catalog.

What to do: If you run master-branch builds after 8.6.3, upgrade to Snipe-IT 8.7.0, where the report export now applies formula escaping like the other CSV exports. Deployments pinned to tagged releases are not vulnerable but should still treat all CSV exports as untrusted: open them in a plain-text editor first, and disable automatic formula evaluation and DDE/external content in Excel, LibreOffice, and Google Sheets. Audit free-text fields (item name, asset tag, serial, company/location names) for cells beginning with =, +, -, @, tab, or CR, and verify that the app.escape_formulas configuration is enabled.