Is there a patch available for CVE-2026-55452?

Yes, a patch is available for CVE-2026-55452. Update the affected software to the latest version immediately.

Snipe-IT CVE-2026-55452

Q: What is the CVSS score of CVE-2026-55452?

CVE-2026-55452 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42997 MEDIUM

Improper Neutralization of Formula Elements in a CSV File (CWE-1236)

2026-07-10 security-advisories@github.com

GHSA-whrx-mmgr-gpcf

Information Disclosure Snipe It Snipeitapp

4.8

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-accessible stored payload requires low-privilege auth (PR:L), mandatory victim interaction to open the CSV (UI:R), and scope change since execution occurs on the viewer's workstation (S:C/C:L/I:L).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 21:02 EUVD

Analysis Generated

Jul 10, 2026 - 20:39 vuln.today

DescriptionCVE.org

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActivityReport() writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged authenticated user to store a formula-like User-Agent that may execute when a report viewer opens the exported CSV in spreadsheet software. This issue is fixed in version 8.5.0.

AnalysisAI

CSV formula injection in Snipe-IT prior to version 8.5.0 enables a low-privileged authenticated user to store a malicious spreadsheet formula via the HTTP User-Agent header, which is then written unescaped into exported Activity Report CSV files. When an administrator or report viewer opens the exported file in spreadsheet software such as Microsoft Excel or LibreOffice Calc, the embedded formula executes within their local application environment, potentially enabling data exfiltration or arbitrary command execution on the viewer's workstation. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 8.5.0.

Technical ContextAI

CWE-1236 (Improper Neutralization of Formula Elements in a CSV File) describes injection vulnerabilities where attacker-controlled input prefixed with formula triggers (=, +, -, @) is written into CSV output without sanitization, causing execution when opened in spreadsheet applications that evaluate formula syntax. In this case, Snipe-IT's PHP backend method Actionlog::logaction() captures the raw HTTP User-Agent header and persists it to the activity log database without sanitization. ReportsController::postActivityReport() subsequently reads these stored values and emits them directly into exported CSV content, again without formula escaping. The attack exploits the implicit trust spreadsheet software places in CSV cell content. No CPE strings were provided in the input data; affected scope is all Snipe-IT deployments running versions prior to 8.5.0.

RemediationAI

Upgrade to Snipe-IT version 8.5.0, which resolves the issue via the fix committed at https://github.com/grokability/snipe-it/commit/7b7d2c87fbc965a7933b1bf9e3f2c331b8c8e19c; the vendor security advisory is at https://github.com/grokability/snipe-it/security/advisories/GHSA-whrx-mmgr-gpcf. If immediate patching is not feasible, restrict the Activity Report export feature to the smallest possible set of highly trusted users, reducing the population who could trigger the final exploitation step. Additionally, instruct all report consumers to open exported CSVs in environments that do not evaluate formula elements - for example, by disabling automatic formula evaluation in Excel's Trust Center, importing the file as plain text, or reviewing in a text editor. Note that this compensating control does not remove already-stored malicious User-Agent payloads from the database; after patching, previously logged malicious entries will be exported safely because the fix applies escaping at export time.