CVE-2026-55452

7.3 Élevée

Publiée le 10/07/2026 à 22:16 · Modifiée le 14/07/2026 à 14:29 · Analysée par le NVD · Source : security-advisories@github.com

Description

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActivityReport() writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged authenticated user to store a formula-like User-Agent that may execute when a report viewer opens the exported CSV in spreadsheet software. This issue is fixed in version 8.5.0.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	4.8 Moyenne	security-advisories@github.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	7.3 Élevée	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-1236

Références

https://github.com/grokability/snipe-it/commit/7b7d2c87fbc965a7933b1bf9e3f2c331b8c8e19c Patch
https://github.com/grokability/snipe-it/releases/tag/v8.5.0 Release Notes
https://github.com/grokability/snipe-it/security/advisories/GHSA-whrx-mmgr-gpcf PatchVendor Advisory

CVE-2026-55452

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs