Snipe-IT EUVD-2026-42997

Exploitation requires: (1) the attacker possesses a valid, low-privileged authenticated account on the Snipe-IT instance (confirmed by PR:L in the CVSS 4.0 vector); (2) the attacker sends at least one authenticated HTTP request with a formula-prefixed User-Agent header, causing Actionlog::logaction() to store the payload; (3) a separate user - typically an administrator with access to the Reports module - must export the Activity Report and open the resulting CSV in spreadsheet software that evaluates formula elements (e.g., Microsoft Excel, LibreOffice Calc). Exploitation is fundamentally limited by the mandatory active user interaction requirement (UI:A): the attack cannot complete without a victim opening the CSV file. Deployments where no administrator ever exports or opens Activity Reports in formula-executing applications are not at risk from the execution stage, though the payload remains stored. The Snipe-IT server itself is not directly compromised; impact is confined to the report viewer's workstation environment.

The CVSS 4.0 score of 4.8 (Medium) accurately reflects the constrained impact profile: while the attack is network-accessible with low complexity and low privilege (AV:N/AC:L/PR:L), mandatory active user interaction is required (UI:A) - a victim administrator must export and open the Activity Report CSV in formula-executing spreadsheet software before the payload fires. The vulnerable Snipe-IT server itself suffers no direct confidentiality or integrity impact (VC:N/VI:N/VA:N); harm is limited to the subsequent system, i.e., the report viewer's workstation (SC:L/SI:L). No CISA KEV listing exists, no public exploit code has been identified, and no EPSS data was provided. The real-world priority is therefore driven primarily by operational habit: organizations where administrators routinely export and open Activity Reports in Excel or LibreOffice Calc carry meaningfully higher risk than those who do not. The stored-injection nature of this flaw means a single malicious User-Agent request persists until the report is generated, broadening the window of exposure beyond a single interaction.

A low-privileged Snipe-IT user sets their HTTP client's User-Agent header to a formula string such as =cmd|'/C powershell -enc ...'!A0 before making authenticated requests to the application. Snipe-IT logs this value verbatim in the activity table. When an administrator later navigates to the Reports section, exports the Activity Report, and opens the resulting CSV in Microsoft Excel, the formula is evaluated by Excel on the administrator's workstation, potentially executing arbitrary commands or exfiltrating data from the admin's local environment. No public proof-of-concept code has been identified, but the attack technique (CSV injection via User-Agent) is well-documented in the security community.