All vulnerabilities
CVE-2026-55154GHSA-xrwp-2gph-985x

EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export

espocrm espocrm
Open in ThreatlineRecord JSON
CVSS
5.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9.3.9Fixed versionGitHub
Published15 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

  • 9.3.9espocrm/espocrm, composerGitHubcomposer require "espocrm/espocrm:^9.3.9"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php inspect only the first byte in sanitizeCellValue(). An authenticated low-privileged user can store a free-text value whose formula trigger is preceded by whitespace or a control character, causing CSV or XLSX export to omit the leading single-quote formula-neutralization prefix. When a privileged user opens the exported file and accepts applicable spreadsheet security prompts, spreadsheet software can ignore the whitespace or control-character prefix and evaluate the cell as a formula, permitting outbound data disclosure and, on legacy configurations with DDE enabled, command execution. This issue is fixed in version 9.3.9.

Text from CVE List

Affected versions 2

  • espocrmaffected: < 9.3.9CVE List
  • espocrm/espocrm, composer<= 9.3.8GitHub

References 3