CVE-2026-55452: Grokability Snipe-IT CSV injection in Activity Report export

CVE-2026-55452 · Severity: medium · CVSS 4 · Published 2026-07-10

Snipe-IT is an open-source asset management application used by organizations to track IT inventory and equipment. A vulnerability allows low-privileged users to inject spreadsheet formulas into activity reports by setting a malicious User-Agent header, which execute when an admin or auditor opens the exported CSV file in spreadsheet software, potentially leading to credential theft or malware downloads.

Technologies: snipe/snipe-it (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-55452 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55452 being exploited in the wild.
How severe is CVE-2026-55452?
Medium severity, with a CVSS score of 4, published 10 July 2026.
Which products and versions are affected?
snipe/snipe-it (Packagist) <= 8.6.1, ECOSYSTEM:introduced=0,fixed=8.6.2.
Is there a fix for CVE-2026-55452?
Yes. snipe/snipe-it (Packagist): upgrade to 8.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55452 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-55452?
Check whether you run snipe/snipe-it (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • snipe/snipe-it (Packagist): upgrade to 8.6.2 or later
    composer require snipe/snipe-it:^8.6.2

Technical details

This is a CSV formula injection vulnerability (CWE-1236) in Snipe-IT's reporting module. The `Actionlog::logaction()` function stores the HTTP User-Agent header directly in the activity log without sanitization. The `ReportsController::postActivityReport()` method later exports this data using plain `fputcsv()`, which does not escape formula-like content (e.g., strings starting with `=`, `+`, `@`, or `-`). An authenticated attacker with low privileges can craft a malicious User-Agent header containing a formula (e.g., `=HYPERLINK("https://attacker.com/","click")`) and trigger a logged action. When a higher-privileged user (admin or report viewer) exports and opens the Activity Report in Excel, LibreOffice, or similar spreadsheet software, the formula executes, enabling credential harvesting, phishing, or malware distribution. The attack requires authentication and user interaction (opening the CSV file), but network reachable and affects confidentiality and integrity of downstream systems. Patched in version 8.6.2.

Affected products

  • grokability Snipe-IT <= 8.6.1

Identifiers

  • CVE-2026-55452
  • GHSA-whrx-mmgr-gpcf

Timeline

  • 2026-08-28: disclosed: Published in GitHub Advisory Database (GHSA-whrx-mmgr-gpcf)
  • 2026-08-28: patched: Fixed in Snipe-IT v8.6.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.