CVE-2026-55154
Deferred Deferred - Pending Action

CSV Formula Injection in EspoCRM

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php inspect only the first byte in sanitizeCellValue(). An authenticated low-privileged user can store a free-text value whose formula trigger is preceded by whitespace or a control character, causing CSV or XLSX export to omit the leading single-quote formula-neutralization prefix. When a privileged user opens the exported file and accepts applicable spreadsheet security prompts, spreadsheet software can ignore the whitespace or control-character prefix and evaluate the cell as a formula, permitting outbound data disclosure and, on legacy configurations with DDE enabled, command execution. This issue is fixed in version 9.3.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-55154
EUVD
EUVD-2026-102105

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
espocrm espocrm < 9.3.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1236 The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a CSV/Formula Injection vulnerability in EspoCRM versions 9.3.8 and earlier. The sanitization mechanism only checks the first byte of a cell value, allowing attackers to bypass protection by using leading whitespace or control characters before formula triggers like =, +, -, or @. When exported files are opened in spreadsheet software, the leading characters are ignored and the cell is evaluated as a formula, enabling malicious actions such as data exfiltration or command execution on legacy systems.

Detection Guidance

Check EspoCRM version with: grep -r "version" application/Espo/Resources/i18n/en_US/Global.json. If version is below 9.3.9, the system is vulnerable. Inspect exported CSV/XLSX files for cells starting with whitespace or control characters followed by formula triggers (=, +, -, @).

Use: find application/Espo/Tools/Export -name "*.php" -exec grep -l "sanitizeCellValue" {} \; to locate affected export processors.

Impact Analysis

An authenticated low-privileged attacker can exploit this by storing a malicious value in a field like a Contact description. When a privileged user exports data to CSV or XLSX and opens the file, spreadsheet software may execute formulas embedded in the data. This could lead to outbound data disclosure via functions like HYPERLINK or WEBSERVICE, or command execution if DDE is enabled on legacy Excel configurations.

Compliance Impact

This vulnerability could lead to unauthorized data exfiltration, violating GDPR's data protection principles and HIPAA's confidentiality requirements. If exploited, it may result in unauthorized access to sensitive personal or health information, potentially leading to compliance breaches and regulatory penalties.

Mitigation Strategies

Upgrade EspoCRM to version 9.3.9 or later immediately. Review and restrict low-privilege user access to fields that may contain free-text input. Monitor exported files for suspicious formula patterns before opening.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55154. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart