CVE-2026-55154
CVE-2026-55154 · EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export
This page contains facts from public vulnerability sources. Check the original advisory before updating.
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php inspect only the first byte in sanitizeCellValue(). An authenticated low-privileged user can store a free-text value whose formula trigger is preceded by whitespace or a control character, causing CSV or XLSX export to omit the leading single-quote formula-neutralization prefix. When a privileged user opens the exported file and accepts applicable spreadsheet security prompts, spreadsheet software can ignore the whitespace or control-character prefix and evaluate the cell as a formula, permitting outbound data disclosure and, on legacy configurations with DDE enabled, command execution. This issue is fixed in version 9.3.9.
CVSS 5.4 · Medium · EPSS 0.2%
- Published
- Updated
Affected products and versions
espocrm
- Versions
- < 9.3.9: Affected
No fix published