Résumé
Snipe-IT has CSV formula injection in Activity Report export
Détails de l’avis
Impact
In Snipe-IT v8.6.1 and lower, Actionlog::logaction() stores the request User-Agent header in user_agent. That value is later included in the Activity Report CSV export by ReportsController::postActivityReport() and written with plain fputcsv().
A low-privileged authenticated user can set a formula-like User-Agent, perform a logged action, and have that value stored in the activity log. If an admin or report viewer later exports the Activity Report and opens it in spreadsheet software, the formula may execute.
Example payload:
User-Agent: =HYPERLINK("https://example.com/","click")
Références
- https://github.com/advisories/GHSA-whrx-mmgr-gpcf
- https://github.com/grokability/snipe-it/security/advisories/GHSA-whrx-mmgr-gpcf
- https://nvd.nist.gov/vuln/detail/CVE-2026-55452
- https://github.com/grokability/snipe-it/commit/7b7d2c87fbc965a7933b1bf9e3f2c331b8c8e19c
- https://github.com/grokability/snipe-it/releases/tag/v8.5.0
Vulnérabilités liées
Tout Supply chain →- HIGHCVE-2026-96627
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
- MEDIUMCVE-2026-96628
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
- CRITICALCVE-2026-105192
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
- HIGHCVE-2026-100349
kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content
- MEDIUMCVE-2026-58494
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
- HIGHGHSA-6fj4-rcr3-r7rr
lopdf has a stack overflow via deeply nested PDF objects