Description

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the code was never included in a tagged release), SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report (GET /admin/settings/location-scoping-report.csv) through a bare fputcsv() call without applying League\Csv\EscapeFormula, unlike the other CSV exports which honor config('app.escape_formulas'). An authenticated user with ordinary create/edit rights can place a spreadsheet formula in free-text fields that appear in the report (item name, asset tag, serial, item or location company name, location name) and arrange for the record to be FMCS-mismatched so it is included in the export. When a superuser downloads the report and opens it in Excel, LibreOffice Calc, or Google Sheets with formula evaluation enabled and external-content warnings dismissed or disabled, cells beginning with =, +, -, @, tab, or CR are executed in the victim's spreadsheet context, enabling data exfiltration (e.g., HYPERLINK/WEBSERVICE) or, on Windows Excel, legacy DDE command execution. This issue is fixed in version 8.7.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-09T14:17:23.277Z",
  "pubdate": "2026-09-09T14:17:23.277Z",
  "executiveSummary": "A CSV Formula Injection vulnerability exists in Snipe-IT master-branch builds following version 8.6.3. The vulnerability originates in the SettingsController::downloadLocationScopingReport method, which fails to sanitize user-supplied input before rendering it into a CSV report.\nThis flaw allows an authenticated attacker with standard create/edit privileges to inject malicious spreadsheet formulas into fields such as asset tags, serial numbers, or location names. When a privileged user, such as a superuser, downloads and opens the resulting report in spreadsheet software like Microsoft Excel or LibreOffice Calc, these formulas are executed within the context of the victim's application.\nThe impact includes potential data exfiltration via network-enabled functions like HYPERLINK or WEBSERVICE and, in certain configurations, Remote Code Execution (RCE) on Windows environments through legacy DDE commands. The vulnerability is categorized as a failure to implement input sanitization for CSV export routines. This issue is resolved in version 8.7.0. Given that the vulnerability requires user interaction by a high-privilege account and the execution of external content, the risk is elevated in environments where administrative users routinely process automated reports.",
  "technicalDetails": "The vulnerability resides in the SettingsController::downloadLocationScopingReport method within Snipe-IT. Unlike other CSV generation endpoints in the application that utilize the League\\Csv\\EscapeFormula library and adhere to the config('app.escape_formulas') global policy, this specific endpoint uses a direct fputcsv() call without any input sanitization or character escaping.\nThe attack flow begins with an authenticated attacker—possessing ordinary create/edit permissions—modifying free-text fields associated with assets or locations. By inserting spreadsheet formula triggers such as '=', '+', '-', '@', tab, or carriage return characters, the attacker crafts a payload that the spreadsheet application interprets as a command rather than plain text.\nFor the exploitation to succeed, the attacker must manipulate data so that the specific record is included in the FMCS (Fixed-Asset Management Control System) location-scoping mismatch report, which is generated via the GET /admin/settings/location-scoping-report.csv endpoint.\nWhen a superuser initiates the download and opens the file in a spreadsheet processor, the application engine parses the malicious cell content. If the user has formula evaluation enabled and security warnings regarding external content are ignored or disabled, the injected commands execute. Payload behavior varies based on the environment; for instance, the WEBSERVICE function can be leveraged to send out-of-band GET requests, effectively exfiltrating sensitive local data or session-related information to an attacker-controlled server. In older versions of Microsoft Excel on Windows, the DDE (Dynamic Data Exchange) protocol can be invoked to spawn arbitrary system processes, leading to full host compromise.\nThe vulnerable component is identified as SettingsController::downloadLocationScopingReport, affecting master-branch builds post-8.6.3, prior to the 8.7.0 release. Authentication is a prerequisite, as the attacker must possess the necessary privileges to modify assets or locations that appear in the target report. Network exposure is limited to the web interface, but the exploitation is inherently asynchronous, relying on a victim downloading and opening the malicious file."
}