CVE-2026-55154: EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php inspect only the first byte in sanitizeCellValue(). An authenticated low-privileged user can store a free-text value whose formula trigger is preceded by whitespace or a control character, causing CSV or XLSX export to omit the leading single-quote formula-neutralization prefix. When a privileged user opens the exported file and accepts applicable spreadsheet security prompts, spreadsheet software can ignore the whitespace or control-character prefix and evaluate the cell as a formula, permitting outbound data disclosure and, on legacy configurations with DDE enabled, command execution. This issue is fixed in version 9.3.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EspoCRMto a version that resolves this vulnerability.Fixed in 9.3.9
Event History
Frequently Asked Questions
Who is exposed to exploitation?
EspoCRM instances prior to 9.3.9 are exposed where a low-privileged authenticated user can store free-text values and a privileged user later exports and opens CSV or XLSX data. Exploitation also depends on the privileged user accepting applicable spreadsheet security prompts.
What does an attacker need to do?
The attacker needs a low-privileged authenticated account and the ability to place a formula-like value in a free-text field, with the formula trigger preceded by whitespace or a control character. They then rely on a privileged user exporting the data and opening it in spreadsheet software that evaluates the cell.
Are command execution and data disclosure equally likely outcomes?
The issue can permit outbound data disclosure when the formula is evaluated. Command execution requires a legacy spreadsheet configuration with DDE enabled, in addition to the export being opened and applicable prompts being accepted.
What version fixes the issue?
Upgrade EspoCRM to version 9.3.9, which fixes the sanitizer handling in CSV and XLSX export processors.